Swift-Attack - Unit Tests For Blue Teams To Aid With Building Detections For Some Common macOS Post Exploitation Methods

Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods. I have included some post exploitation examples using both command line history and on disk binaries which should be easier for detection as well as post exploitation examples using API call...

CVE-2021-23845

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

CVE-2021-23845

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

CVE-2021-23845

CVE-2021-23845 (Bosch B426 Conettix). The Bosch B426 family (e.g., B426, B426-CN/B429-CN, B426-M) has an authentication/session handling issue in the web configuration interface that allows session hijacking due to an improper access control design. Public descriptions confirm the vulnerability w...

CVE-2021-23845 B426 Web Configuration Authentication Bypass

This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. This vulnerability was discovered by a security researcher in B426 and found during internal product tests in B426-CN/B429-CN, and B426-M and has been fixed already starting from...

SUSE: Security Advisory (SUSE-SU-2020:1493-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-11184 · Silverstripe +3 · Silverstripe +2

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity XXE attacks. When this developer utility is misused for purposes involving external or user submitted data in custom...

7.13: Upgrade Confluence to latest Adopt OpenJDK versions 11.0.12

This issue includes running tests against JDK 11 latest11.0.127 and also bundling this JDK in installer...

7.13: Upgrade Confluence to latest Adopt OpenJDK versions 11.0.12

This issue includes running tests against JDK 11 latest11.0.127 and also bundling this JDK in installer...

How to Implement Secure and Compliant IaC

Success lies in security True separation of developer and security teams is becoming a thing of the past. Today’s cloud environments enable deployments at previously unheard-of speed and scale; there simply isn’t time to build infrastructure, then code, then hand it all off for security...

python: Unsafe use of eval() on data retrieved via HTTP in the test suite

In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...

rt-tests bug fix and enhancement update

An update is available for rt-tests. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpris...

rt-tests bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CVE-2021-3315

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible...

CVE-2021-3315

CVE-2021-3315 is a stored XSS vulnerability in JetBrains TeamCity, present on the test page, affecting TeamCity server versions prior to 2020.2.2. The connected documents consistently describe a stored XSS on the test page but do not provide detailed technical specifics (e.g., exploit vectors, ex...

com.backbase.oss:boat-diff (>=0.1.0.0, <=0.1.5), com.backbase.oss:boat-engine (>=0.1.0.0, <=0.1.5) +7 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.0.1)

org.openapitools:openapi-generator MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - com.backbase.oss:boat-diff =0.1.0.0, =0.1.0.0, =0.1.0.0, =0.1.0.0, =0.1.3, =0.1.5 -...

com.backbase.oss:boat-maven-plugin (>=0.1.9, <=0.16.15), com.backbase.oss:boat-scaffold (>=0.4.0, <=0.16.15) +31 more potentially affected by CVE-2021-21430 via org.openapitools:openapi-generator (4.3.1)

org.openapitools:openapi-generator MAVEN version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.openapitools:openapi-generator and may be impacted: - com.backbase.oss:boat-maven-plugin =0.1.9, =0.4.0, =0.4.0, =0.1.9, =1.0.1, =0.10.2, =4.3.11...

CVE-2021-3315: Improper Neutralization of Input During Web Page Generation

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible...

PT-2021-20056

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2020.2.2 Description The issue allows for stored XSS on a tests page, which could potentially lead to malicious script execution. Recommendations For versions prior to 2020.2.2, update to version 2020.2.2 o...

Object injection via local phar file

This is a security release. SECURITY Fixes CVE-2020-36326, a regression of CVE-2018-19296 object injection introduced in 6.1.8, see SECURITY.md for details Reject more file paths that look like URLs, matching RFC3986 spec, blocking URLS using schemes such as ssh2 Ensure method signature consisten...