XM Cyber’s Post

Hands-on Review: Myrror Security Code-Aware and Attack-Aware SCA: Introduction The modern software supply chain represents an ever-evolving threat landscape, with each package added to the manifest introducing new attack vectors. To meet industry requirements, organizations must maintain a fast-paced development process while staying up-to-date with the latest security patches. However, in practice, developers often face a large amount of security work without

CVE&2024&38856: Pre&Auth RCE Vulnerability in Apache OFBizIntroductionOn August 5, 2024, researchers at SonicWall discovered a zero-day security flaw in Apache OFBiz tracked as CVE-2024-38856. The vulnerability, which has been assigned a CVSS score of 9.8, allows threat actors to perform pre-authentication remote code execution

Learn the essentials of Veracode #DAST with our comprehensive guide! Discover how to get started with #applicationsecurity testing to protect your software from vulnerabilities.

GitLab Product Security Update Advisory (CVE&2024&7047)Overview GitLab has released an update to address a vulnerability in their products. Users of affected versions are advised to update to the latest version. Affected Products CVE-2024-7047 GitLab CE/EE versions: 16.6 (inclusive) ~ 17.0.5 (exclusive) GitLab CE/EE versions: 17.1 (inclusive) ~ 17.1.3 (exclusive) GitLab CE/EE versions: 17.2 (inclusive) ~ 17.2.1 (exclusive) Resolved Vulnerabilities XSS vulnerability that could allow an attacker to execute arbitrary script in the context of the currently logged in user(CVE-2024-7047) Vulnerability Patches Vulnerability Patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version. CVE-2024-7047 GitLab CE/EE version: 17.0.5 GitLab CE/EE version: 17.1.3 GitLab CE/EE version: 17.2.1 Referenced Sites [1] CVE-2024-7047 Detail https://lnkd.in/dGNBGRxv [2] CVE-2024-7047.json https://lnkd.in/dmCP57cE Article Link: GitLab Product Security Update Advisory (CVE-2024-7047) – ASEC 1 post - 1 participant Read full topic GitLab, Product, Security, Update, Advisory, CVE-2024-7047

Dynamic Application Security Testing (DAST) tools help identify security flaws and vulnerabilities in web applications and APIs. Get on board with the name that is well known - Fortify DAST!

📢 New Blog: Common Vulnerabilities Detected by SAST – All You Need To Know. Cyberattacks exploiting web application vulnerabilities have surged by 180% between 2022 and 2023. This alarming trend underscores the urgent need for robust application security. Discover why SAST tools are essential and how to choose the right ones in our latest blog. Read more: https://lnkd.in/dTxFxBRU #AppSec #SAST #SecureCoding #DevSecOps

The Top SAP Vulnerabilities and How To Protect Your Systems

🚨 PATCH ALERT 🚨 Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP! The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the built-in command line interface. Jenkins uses the args4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. A threat actor could exploit this quirk to read arbitrary files on the Jenkins controller file system using the default character encoding of the Jenkins controller process his command parser has a feature that replaces an @ character followed by a file path in an argument with the file's contents (expandAtFiles). This feature is enabled by default and Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable it. While attackers with "Overall/Read" permission can read entire files, those without it can read the first three lines of the files depending on the CLI commands. The development comes nearly a year after Jenkins addressed a pair of severe security vulnerabilities dubbed CorePlague (CVE-2023-27898 and CVE-2023-27905) that could lead to code execution on targeted systems. As a short-term workaround until the patch can be applied, it's recommended to turn off access to the CLI. https://lnkd.in/gu8Tk2MT

We recently published a buyers guide on security testing. Read on to learn why security testing is important, what the biggest areas of concern are, and a breakdown of the popular tools that companies are using to get the job done. https://lnkd.in/eVAW2wSc

If you are running: Fortinet FortiClient EMS, Fortinet FortiGate's, or Jenkins you may be susceptible to a breach! Fresh off the command line, we have the Top Trending #CVEs for March. Read this latest blog from our Security Research team to learn how to remediate/mitigate these vulnerabilities. Prioritize now! #cybersecurity #vulnerabilitymanagement #ctem #rbvm https://hubs.li/Q02sz2wN0