Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Vulnerability

Snyk

Automatic source locations with Rego

Feb 12, 2024 By Jasper Van der Jeugt In Snyk
At Snyk, we are big fans of Open Policy Agent’s Rego. Snyk IaC is built around a large set of rules written in Rego, and customers can add their own custom rules as well. We recently released a series of improvements to Snyk IaC, and in this blog post, we’re taking a technical dive into a particularly interesting feature — automatic source code locations for rule violations.
Read Post
splunk

CVSS: The Common Vulnerability Scoring System

Feb 12, 2024 By Leanne Mitton In Splunk
Cybersecurity measures have become important in the ever-evolving landscape of digital threats. With organizations increasingly relying on digital technologies to drive their operations, the risk of cyberattacks becomes more likely, with potential consequences ranging from financial losses to reputational damages.
Read Post
nucleus

How Nucleus Security's $43M Series B Funding Powers Enterprise Risk-Based Vulnerability Management Innovation

Feb 12, 2024 By Steve Carter In Nucleus
We at Nucleus Security are thrilled to share our journey and vision following our recent $43 million Series B funding round. This investment, led by Arthur Ventures and Lead Edge Capital, is a testament to our commitment to leading the charge in vulnerability management innovation and our dedication to protecting digital infrastructures worldwide. Read the full press release here.
Read Post
algosec

5 Best Network Vulnerability Scanning Tools in 2024

Feb 11, 2024 By Tsippi Dach In AlgoSec
Network vulnerability scanning provides in-depth insight into your organization’s security posture and highlights the specific types of vulnerabilities attackers may exploit when targeting it. These tools work by systematically scanning your network environment — including all desktops, laptops, mobile endpoints, servers, and other assets for known weaknesses and misconfigurations. Your analyzer then produces a detailed report that tells you exactly how hackers might breach your systems.
Read Post
centripetal

Fortinet Vulnerability: CVE-2024-21762

Feb 9, 2024 By Lauren Farrell In Centripetal
On Thursday, February 8th, the Fortinet Product Security Incident Response Team released an advisory (FG-IR-24-015) notifying of an out-of-bound write vulnerability in their SSL VPN tracked as CVE-2024-21762. The vulnerability “may allow a remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests”.
Read Post

Vulnerability A03 : Injection - OWASP TOP 10

Feb 9, 2024 By VISTA InfoSec In VISTA InfoSec
Welcome to our latest video on the OWASP Top 10, focusing on Vulnerability A03: Injection. This video is designed to provide a comprehensive understanding of injection vulnerabilities, which are among the most common and dangerous security risks in web applications. In this video, we will explore the concept of injection vulnerabilities, their various types, and how they can be identified. We will also look at real-world examples to illustrate the potential impacts of these vulnerabilities when they are exploited.
View Video
Arctic Wolf

Exploitation of Confluence Server Vulnerability CVE-2023-22527 Leading to C3RB3R Ransomware

Feb 8, 2024 By Stefan Hostetler, Markus Neis, Kyle Pagelow In Arctic Wolf
On January 4, 2024, Atlassian disclosed CVE-2023-22527, a template injection vulnerability affecting Confluence Data Center and Server versions 8.0.0 to 8.5.3. The vulnerability allows for unauthenticated remote code execution to be achieved on affected versions of the software. Arctic Wolf Labs has observed evidence of C3RB3R ransomware, as well as several other malicious payloads, being deployed following exploitation of CVE-2023-22527. We present our preliminary findings here.
Read Post
jfrog

Analyzing common vulnerabilities introduced by Code-Generative AI

Feb 7, 2024 By Natan Nehorai In JFrog
Artificial Intelligence tools such as Bard, ChatGPT, and Bing Chat are the current big names in the Large Language Model (LLM) category which is on the rise. LLMs are trained on vast data sets to be able to communicate by using everyday human language as a chat prompt. Given the flexibility and potential of LLMs, companies are integrating them into many workflows inside the tech industry to make our lives better and easier.
Read Post
Subscribe to Vulnerability

Copyright © 2024 OpsMatters™. All rights reserved.