330 matches found
vmwgfx Driver File Descriptor Handling Privilege Escalation Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vmwgfx Driver File Descriptor Handling Priv Esc', 'Description' = %q If the vmwgfx driver fails to copy the 'fencerep' object to userland, it tri...
Never Mind the Ears, Here's Security Nation
It's another year down and another season down for Security Nation. With the close of our fifth season, I wanted to take a minute here to reflect on who we spoke with and what we talked about. The show titles focus as you would expect on the individual interview subjects, but there's a bunch of...
Last Years Open Source - Tomorrow's Vulnerabilities
Linus Torvalds, the creator of Linux and Git, has his own law in software development, and it goes like this: "given enough eyeballs, all bugs are shallow." This phrase puts the finger on the very principle of open source: the more, the merrier - if the code is easily available for anyone and...
CVE-2022-36804
creationtimestamp| type| source ---|---|--- 2022-08-27 09:06:15+00:00| seen| https://t.me/cyberbannewsir/6534 2022-08-29 11:27:11+00:00| seen| https://www.cert.at/de/warnungen/2022/8/kritische-sicherheitslucke-in-atlassian-bitbucket-server-and-data-center-updates-verfugbar 2022-08-29...
Pushing Open-Source Security Forward: Insights From Black Hat 2022
Open-source security has been a hot topic in recent years, and it's proven to be something of a double-edged sword. On the one hand, there's an understanding of the potential that open-source tools hold for democratizing security, making industry best practices accessible to more organizations an...
Google Created 'Open Source Maintenance Crew' to Help Secure Critical Projects
Google on Thursday announced the creation of a new "Open Source Maintenance Crew" to focus on bolstering the security of critical open source projects. Additionally, the tech giant pointed out Open Source Insights as a tool for analyzing packages and their dependency graphs, using it to determine...
[Security Nation] Jim O’Gorman and g0tmi1k on Kali Linux
!\Security Nation\ Jim O’Gorman and g0tmi1k on Kali Linuxhttps://blog.rapid7.com/content/images/2022/05/securitynationlogo--1-.jpg In this episode of Security Nation, Jen and Tod sit down with Jim O’Gorman and Ben “g0tmi1k” Wilson of Offensive Security to chat about Kali Linux. They walk our host...
A scanning tool for open-sourced software packages? Yes, please!
The Open Source Security Foundation OpenSSF, a collective of industry leaders aimed at improving the security of open-source software OSS, recently announced the release of a prototype tool that scans for malicious packages in open source repositories. This tool, conveniently called Package...
Here's a New Tool That Scans Open-Source Repositories for Malicious Packages
The Open Source Security Foundation OpenSSF has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packag...
NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages
A "logical flaw" has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them. The supply chain threat has been dubbed "Package...
Mz Automation Libiec61850 安全漏洞
Mz Automation Libiec61850 is an open source library for the IEC 61850 protocol from Mz Automation. A security vulnerability exists in Mz Automation GmbH libiec61850 1.5.0 that originates from a specially crafted series of network requests that could result in a denial of service. An attacker can...
[Security Nation] Kate Stewart on Open-Source Projects at the Linux Foundation
!\Security Nation\ Kate Stewart on Open-Source Projects at the Linux Foundationhttps://blog.rapid7.com/content/images/2022/04/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Kate Stewart, VP of Dependable Embedded Systems at the Linux Foundation, about the...
CVE-2022-22547
Simple Diagnostics Agent - versions 1.0 up to version 1.57., allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits...
[Security Nation] Matthew Kienow on Open-Source Security and the Recog Framework
!\Security Nation\ Matthew Kienow on Open-Source Security and the Recog Frameworkhttps://blog.rapid7.com/content/images/2022/03/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Matthew Kienow, Senior Software Engineer at Rapid7, about open-source security – a subje...
Keylime 安全漏洞
Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. There is a security vulnerability in Keylime, no information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...
Finding Vulnerabilities in Open Source Projects
The Open Source Security Foundation announced $10 million in funding from a pool of tech and financial companies, including $5 million from Microsoft and Google, to find vulnerabilities in open source projects: The "Alpha" side will emphasize vulnerability testing by hand in the most popular...
Open-Source Security: Getting to the Root of the Problem
The past few weeks have shown us the importance and wide reach of open-source security. In December 2021, public disclosure of the Log4Shell vulnerability in Log4j, an open-source logging library, caused a cascade of dependency analysis by developers in organizations around the world. The inciden...
S3Scanner Path Traversal Vulnerability
S3Scanner is an open source tool for finding open S3 storage buckets and dumping their contents by Dan Salmon, an individual developer in the United States. S3Scanner prior to version 2.0.2 suffers from a path traversal vulnerability that stems from a failure of a networked system or product to...
Heap-based Buffer Overflow in allinurl/goaccess
Description Good evening and Happy Turkey Day! We are truly thankful for the Open Source Security community this year. Whilst testing goaccess built from commit 9774249, we discovered a crafted log which can trigger a heap-buffer-overflow during a memcmp operation on line 1525 of /src/parser.c...