GitLab 授权问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An authorization issue vulnerability exists in GitLab CE/...

GitLab 权限许可和访问控制问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab suffers from a privilege-permission and...

5 Ways Your Software Supply Chain is Out to Get You, Part 3: Exploit Open Source Libraries

In previous posts, we explained how two kinds of supply chain attack methods, Vendor Compromise and Exploit Third Party Applications, are threatening software supply chains, transferring an extraordinary amount of risk downstream to the organizations and users that trust and depend on them. In th...

Security Bulletin: wscanhw and wscansw vulnerabilities in scanner component of IBM License Metric Tool v9, v7.5, 7.2.2, IBM Endpoint Manger for Software Use Analysis v9 and IBM Tivoli Asset Discovery for Distributed v7.5, v7.2.2

Summary CIT scanner component contains format string vulnerability in wscanhw executable and stack overflow vulnerability in wscansw executable. Successful exploitation of the vulnerabilities allows for scanner process manipulation, and possibly crashing the process. Vulnerability Details CVEID:...

11-13 year old girls most likely to be targeted by online predators

The Internet Watch Foundation IWF, a not-for-profit organization in England whose mission is "to eliminate child sexual abuse imagery online", has recently released its analysis of online predator victimology and the nature of sexual abuse media that is currently prevalent online. The scope of th...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

Design/Logic Flaw

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-30702)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A cross-site scripting vulnerability exists in GitLab version 12.9 and later, which stems from scop...

5 Ways Your Software Supply Chain is Out to Get You, Part 2: Exploit Third Party Applications

In Part 1 of this series, we explained how and why our software supply chain transfers an extraordinary amount of risk downstream to the organizations and users that trust and depend on it. We also presented evidence suggesting that 2021 may well be the year of the Software Supply Chain attack...

GitLab 跨站脚本漏洞

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A cross-site scripting vulnerability exists in GitLab version 12.9 and later, which stems from scop...

How to protect serverless and container applications with RASP

With increased demand for container and serverless technology, the need for enhanced security is inevitable. Learn how to secure serverless and container applications using runtime application self-protection RASP...

RHEL 8 : kernel (RHSA-2021:1272)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1272 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Use after free via PI futex...

Denial Of Service (DoS)

thunderbird is vulnerable to denial of service. An attacker is able to prevent a user from sending encrypted email to a correspondent via a malicious OpenPGP key with a subkey that has an invalid self signature...

Virtuozzo Hybrid Infrastructure 4.5 Update 1 Hotfix 2 (4.5.1-34)

This update provides fixes for the admin and self-service panels. Vulnerability id: VSTOR-42074 Unable to add a network interface to an existing VM in the self-service panel. Vulnerability id: VSTOR-42954 Added a message about disabling security groups for a VM network interface. Vulnerability id...

Fedora 32 : chromium (2021-141d8640ce)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-141d8640ce advisory. - Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM...

Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability (cisco-sa-cucm-selfcare-VRWWWHgE)

According to its self-reported version, the Self Care Portal of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME is affected by authorization bypass vulnerability due to insufficient validation of user-supplied data...

Cisco ClamAV for Windows DLL Hijacking (cisco-sa-amp-imm-dll-tu79hvkO)

According to its self-reported version, ClamAV for Windows is affected by a vulnerability in the dynamic link library DLL loading mechanism due to insufficient validation of directory search paths at run time. An authenticated, local attacker can exploit this, by placing a malicious DLL file on a...