Aggregator

A vulnerability classified as problematic was found in HP HP-UX B.11.00/B.11.04/ B.11.11. This vulnerability affects unknown code of the file /tmp of the component Temp File Handler. The manipulation leads to symlink following. This vulnerability was named CVE-2003-1099. Attacking locally is a requirement. There is no exploit available.

如果从漏洞可以利用的角度出发，那误报率就是很高，因为这些CVE漏洞并不都能被利用、结合具体业务场景更不会触发漏洞（实际可能并没有使用到存在漏洞的配置或函数）...但从治理角度来说，不能仅看误报率，而是要看这个SCA工具的拆包能力和漏洞库。 从目前遇到的情况来看，想向大家分享三条真相： 1、SCA工具普遍对C/C++使用的开源组件识别不够好； 2、自家团队没弄出来POC的漏洞，不代表外部人弄不出来； 3、对开源组件的片段代码引用、代码查重，将会越来重视。 以上1-2点都是自己血淋淋的教训，而且还都发生在今年的国家级攻防演习中，希望在做开源安全治理时有所启发。 更多软件安全内容，可以访问： 1、SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 设计阶段应开展哪些安全活动？ 有哪些不错的安全设计参考资料？ 安全设计要求怎么做才能落地？ 有哪些威胁建模方法论？ 有哪些威胁建模工具？ 如何开始或实施威胁建模？ 威胁建模和架构安全评审，有何异同？ 编码阶段，开展哪些安全活动？ 如何选择静态代码扫描(SAST)工具？ 如何选择开源组件安全扫描(SCA)工具？ SCA工具扫描出很多漏洞，如何处理？ SCA工具识别出高风险协议，如何处理？ 如何制定一份有用的开发安全规范？ 如何做到开发安全规范的有效实施？ 应该如何选型代码安全扫描工具？ 代码安全扫描应该设置哪些指标？ 如何提升开发人员的安全意识？ 白盒检测工具存在局限性，如何进行补偿？ SCA用什么系统做，自研还是外购？ 有没有好用的SDL平台？ Sonar是否好用以及误报率咋样？ SDL 34/100问：如何推进有问题的jar包更新？ 2、SDL创新实践系列 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 从安全视角，看研发安全 数字化转型下的研发安全痛点

Can Cloud-Native Security Be a Game-Changer for Your SOC Teams? In today’s complex digital landscape, organizations are increasingly challenged to protect their data while ensuring compliance with evolving cybersecurity regulations. From finance to healthcare, businesses are recognizing the need for a more comprehensive approach to securing machine identities, especially Non-Human Identities (NHIs). Could effective NHI […]

The post Empower Your SOC Teams with Cloud-Native Security Solutions appeared first on Entro.

The post Empower Your SOC Teams with Cloud-Native Security Solutions appeared first on Security Boulevard.

Why Should Proactive Security Management of Machine Identities Be a Priority? With the rise of digitalization across various sectors, organizations have ramped up their security measures to safeguard sensitive data. An area that often gets overlooked in this process, yet is crucial to robust data security, is the management of non-human identities (NHIs). These NHIs, […]

The post Proactively Securing Machine Identities to Prevent Attacks appeared first on Entro.

The post Proactively Securing Machine Identities to Prevent Attacks appeared first on Security Boulevard.

How Can We Empower Security with Cloud Compliance Innovations? As we continue to leverage cloud services for our businesses, one cannot ignore the escalating complexity of cybersecurity. Non-Human Identities (NHIs) and Secrets Security Management has emerged as a core player in empowering security in this dynamic environment. But what is an NHI? How do they […]

The post Empower Your Security with Cloud Compliance Innovations appeared first on Entro.

The post Empower Your Security with Cloud Compliance Innovations appeared first on Security Boulevard.

Can You Truly Be Confident in Your Approach to Secrets Management? Cybersecurity is a crucial element in today’s digital landscape, but how can organizations ensure they’re confidently managing their non-human identities and secrets? This is a question that many professionals have, regardless of their industry — be it finance, healthcare, travel, or a DevOps and […]

The post Build Your Confidence in Secrets Sprawl Management appeared first on Entro.

The post Build Your Confidence in Secrets Sprawl Management appeared first on Security Boulevard.

A vulnerability was found in Luca Deri ntop 1.2a7 9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Mode. The manipulation leads to path traversal. This vulnerability is known as CVE-2000-0705. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in HP HP-UX 11.22. This affects an unknown part of the component xserver. The manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-2003-1098. Local access is required to approach this attack. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in HP HP-UX up to 11.22. It has been rated as critical. Affected by this issue is some unknown functionality of the file rexec. The manipulation of the argument -l leads to memory corruption. This vulnerability is handled as CVE-2003-1097. An attack has to be approached locally. Furthermore, there is an exploit available.

A vulnerability was found in Sun Solaris. It has been classified as very critical. Affected is an unknown function of the component Solstice AdminSuite. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2003-0722. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, has been found in GnuPG up to 1.2.3. Affected by this issue is some unknown functionality of the component ElGamal Key Type 20 Handler. The manipulation leads to an unknown weakness. This vulnerability is handled as CVE-2003-0971. The attack needs to be done within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in Hitachi Groupmax Mail Security Option 6.0 and classified as critical. This vulnerability affects unknown code of the component SMIME Message Handler. The manipulation leads to memory corruption. This vulnerability was named CVE-2003-0564. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Wietse Venema Postfix up to 2001-11-15. It has been classified as problematic. This affects an unknown part of the component Address Parser. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2003-0540. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Mandrakesoft Mandrake Linux. It has been classified as critical. Affected is an unknown function of the component PDF Viewer. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2003-0434. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Cisco IOS up to 12.2. This affects an unknown part of the component Account Handler. The manipulation leads to cryptographic issues. This vulnerability is uniquely identified as CVE-2003-0512. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Ethereal 0.9.11. It has been rated as critical. Affected by this issue is some unknown functionality of the component Mount/PPP Dissector. The manipulation leads to integer coercion error. This vulnerability is handled as CVE-2003-0357. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Ethereal 0.9.12. Affected is an unknown function of the component Protocol Dissector. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2003-0428. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenBSD OpenSSH 3.6.1. It has been declared as critical. This vulnerability affects unknown code of the component Reverse Mapping Handler. The manipulation leads to improper privilege management. This vulnerability was named CVE-2003-0386. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Ethereal 0.9.11. It has been declared as very critical. Affected by this vulnerability is an unknown functionality of the component AIM/GIOP Grypthon/OSPF/PPTP/Quake/Quake2/Quake3/Rsync/SMB/SMPP/TSP Dissector. The manipulation leads to off-by-one. This vulnerability is known as CVE-2003-0356. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Nulllogic Null HTTP Server up to 0.5.0. This vulnerability affects unknown code of the component Content-Length Header Handler. The manipulation leads to memory corruption. This vulnerability was named CVE-2002-1496. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.