A survey of FedRAMP’s new supply chain requirements

Over the past few years, supply chain management has shifted from a background requirement that everyone unknowingly relies upon, to being a commonly talked about aspect of our everyday lives. The Federal government has ramped up its effort to gain a handle on supply chain threats as a result of...

Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation OpenSSF has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packag...

FBI warns food and agriculture to brace for seasonal ransomware attacks

The Federal Bureau of Investigation FBI recently released a Private Industry Notification warning agriculture cooperatives also known as "farmers co-ops" of the looming danger of well-timed ransomware attacks. The agency warns that during the critical planting and harvesting seasons, attacks coul...

Everything you need to know to create a Vulnerability Assessment Report

You've been asked for a Vulnerability Assessment Report for your organisation and for some of you reading this article, your first thought is likely to be "What is that?" Worry not. This article will answer that very question as well as why you need a Vulnerability Assessment Report and where you...

NPM Bug Allowed Attackers to Distribute Malware as Legitimate Packages

A "logical flaw" has been disclosed in NPM, the default package manager for the Node.js JavaScript runtime environment, that enables malicious actors to pass off rogue libraries as legitimate and trick unsuspecting developers into installing them. The supply chain threat has been dubbed "Package...

How to Strategically Scale Vendor Management and Supply Chain Security

This post is co-authored by Collin Huber Recent security events — particularly the threat actor activity from the Lapsu$ group, Spring4Shell, and various new supply-chain attacks — have the security community on high alert. Security professionals and network defenders around the world are wonderi...

GSD-2022-1002439 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.276 by commit...

GSD-2022-1002356 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.238 by commit...

GSD-2022-1002353 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.238 by commit...

GSD-2022-1002252 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

GSD-2022-1002246 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

GSD-2022-1002095 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.110 by commit...

GSD-2022-1002087 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.110 by commit...

GSD-2022-1001858 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001848 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

GSD-2022-1001545 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit...

GSD-2022-1001231 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...

Discover the anatomy of an external cyberattack surface with new RiskIQ report

The internet is now part of the network. That might sound like hyperbole, but the massive shift to hybrid and remote work and a multicloud environment means security teams must now defend their entire online ecosystem. Recent ransomware attacks against internet-facing systems have served as a...

Discover the anatomy of an external cyberattack surface with new RiskIQ report

The internet is now part of the network. That might sound like hyperbole, but the massive shift to hybrid and remote work and a multicloud environment means security teams must now defend their entire online ecosystem. Recent ransomware attacks against internet-facing systems have served as a...

Vulnerabilities fixed in Oracle Supply Chain

Oracle has fixed vulnerabilities in the following Supply Chain products: Advanced Supply Chain Planning Transportation Management Autovue for Agile Product Lifecycle Management. Agile Engineering Data Management Agile PLM MCAD Connector Agile PLM Framework Product Lifecycle Analytics The...