Aggregator

仅从回答问题的角度来说，安全SDK肯定不能覆盖全owasp top 10(当前还是2021版)，因为在这个列表中涉及到的安全问题范围比较广，比如： 1、不安全的设计、使用自带缺陷和过时的组件（属于设计阶段该考虑的问题）； 2、安全配置错误、安全日志和监控故障，也与安全SDK无直接关系。 回归到这个问题本质，安全SDK能够解决的应该是常见web漏洞，如owasp top 10中的注入类、SSRF，之外的如文件上传、反序列化等。 经过一些实践之后，发现比较好的方式还是在开发框架层面做安全，因为现在的框架提供越来越多的安全功能，正确使用就能解决很多漏洞，所以安全团队的关注点也可以放到安全的开发框架及引导开发正确使用。 更多软件安全内容，可以访问： 1、SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 设计阶段应开展哪些安全活动？ 有哪些不错的安全设计参考资料？ 安全设计要求怎么做才能落地？ 有哪些威胁建模方法论？ 如何选择开源组件安全扫描(SCA)工具？ SCA工具扫描出很多漏洞，如何处理？ SCA工具识别出高风险协议，如何处理？ 应该如何选型代码安全扫描工具？ 白盒检测工具存在局限性，如何进行补偿？ SCA用什么系统做，自研还是外购？ 有没有好用的SDL平台？ Sonar是否好用以及误报率咋样？ 如何推进有问题的jar包更新？ SCA工具的误报率怎样？ 在研发安全流程落地方面，有何经验？ 如何说服业务完成checklist自检？ sdl会对项目变更代码做review吗？ 如何展示SDL的成果或效果？ 怎么解决源代码两张皮导致安全失效？ 开发安全培训是否有效？ 安全组件如何在SDL中落地？ SDL 44/100问：如何安全管理研发提交代码到GitHub进行开源？ 2、SDL创新实践系列 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 从安全视角，看研发安全 数字化转型下的研发安全痛点

仅从回答问题的角度来说，安全SDK肯定不能覆盖全owasp top 10(当前还是2021版)，因为在这个列表中涉及到的安全问题范围比较广，比如： 1、不安全的设计、使用自带缺陷和过时的组件（属于设计阶段该考虑的问题）； 2、安全配置错误、安全日志和监控故障，也与安全SDK无直接关系。 回归到这个问题本质，安全SDK能够解决的应该是常见web漏洞，如owasp top 10中的注入类、SSRF，之外的如文件上传、反序列化等。 经过一些实践之后，发现比较好的方式还是在开发框架层面做安全，因为现在的框架提供越来越多的安全功能，正确使用就能解决很多漏洞，所以安全团队的关注点也可以放到安全的开发框架及引导开发正确使用。 更多软件安全内容，可以访问： 1、SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 设计阶段应开展哪些安全活动？ 有哪些不错的安全设计参考资料？ 安全设计要求怎么做才能落地？ 有哪些威胁建模方法论？ 如何选择开源组件安全扫描(SCA)工具？ SCA工具扫描出很多漏洞，如何处理？ SCA工具识别出高风险协议，如何处理？ 应该如何选型代码安全扫描工具？ 白盒检测工具存在局限性，如何进行补偿？ SCA用什么系统做，自研还是外购？ 有没有好用的SDL平台？ Sonar是否好用以及误报率咋样？ 如何推进有问题的jar包更新？ SCA工具的误报率怎样？ 在研发安全流程落地方面，有何经验？ 如何说服业务完成checklist自检？ sdl会对项目变更代码做review吗？ 如何展示SDL的成果或效果？ 怎么解决源代码两张皮导致安全失效？ 开发安全培训是否有效？ 安全组件如何在SDL中落地？ SDL 44/100问：如何安全管理研发提交代码到GitHub进行开源？ 2、SDL创新实践系列 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 从安全视角，看研发安全 数字化转型下的研发安全痛点

Are Secrets Rotation Processes a Keystone in Your Cybersecurity Strategy? The digital business landscape has evolved with technologies enabling organizations to seamlessly maneuver their operations in the cloud. As a cybersecurity professional, have you considered that as we accelerate towards a future driven by automation, the effective management of Non-Human Identities (NHIs) and secrets rotation […]

The post Achieve Satisfaction with Streamlined Secrets Rotation Processes appeared first on Entro.

The post Achieve Satisfaction with Streamlined Secrets Rotation Processes appeared first on Security Boulevard.

Why is Mastering Least Privilege Essential? The least privilege principle remains a cornerstone for securing machine identities and their secrets. However, many organizations still grapple with the practicalities of implementing and maintaining this vital strategy. The consequences of failing to master least privilege can be dire, leading to unauthorized access, data breaches, and cybersecurity incidents. […]

The post Empowering Security: Mastering Least Privilege appeared first on Entro.

The post Empowering Security: Mastering Least Privilege appeared first on Security Boulevard.

Name: hxp 38C3 CTF (an hxp CTF event.)
Date: Dec. 27, 2024, 8 p.m. — 29 Dec. 2024, 20:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Location: online, optionally @ 38C3
Offical URL: https://2024.ctf.link/
Rating weight: 98.14
Event organizers: hxp

Name: ASIS CTF Finals 2024 (an ASIS CTF Finals event.)
Date: Dec. 28, 2024, 2 p.m. — 29 Dec. 2024, 14:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://asisctf.com/
Rating weight: 92.75
Event organizers: ASIS

A vulnerability classified as critical was found in code-projects Chat System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/chatroom.php. The manipulation of the argument id leads to sql injection. This vulnerability is known as CVE-2024-13020. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as problematic, was found in OTRS. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2012-4600. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Cisco IOS up to 12.4/15.2 and classified as critical. Affected by this issue is some unknown functionality of the component DHCPv6 Handler. The manipulation leads to improper input validation. This vulnerability is handled as CVE-2012-4623. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Cisco IOS up to 15.2. It has been rated as critical. This issue affects some unknown processing of the component BGP Handler. The manipulation leads to improper input validation. The identification of this vulnerability is CVE-2012-4617. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in EMC NetWorker up to 8.0.0.1 and classified as very critical. This issue affects some unknown processing. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2012-4607. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Siemens Automation License Manager up to 5.0. It has been classified as problematic. Affected is an unknown function of the component License Manager. The manipulation leads to improper resource management. This vulnerability is traded as CVE-2012-4691. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as very critical, has been found in Ecava IntegraXor 3.71/3.72/4.00. Affected by this issue is some unknown functionality of the file PE3DO32A.ocx of the component ActiveX Control. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2012-4700. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in OTRS. This issue affects some unknown processing. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2012-4751. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Microsoft Windows 7/Server 2003/Server 2008/Vista/XP. This vulnerability affects unknown code of the component Email File Name Parser. The manipulation leads to code injection. This vulnerability was named CVE-2012-4774. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical has been found in Microsoft Internet Explorer 6/7/8. This affects the function CDwnBindInfo in the library mshtml.dll. The manipulation leads to improper resource management. This vulnerability is uniquely identified as CVE-2012-4792. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Due to its background and reception, this vulnerability has an historic impact. A worm is spreading, which is automatically exploiting this vulnerability. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in IBM AIX 6.1/7.1. Affected by this vulnerability is an unknown functionality of the component FTP Server. The manipulation leads to improper access controls. This vulnerability is known as CVE-2012-4845. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in IBM Power 5 and classified as very critical. This vulnerability affects unknown code. The manipulation leads to credentials management. This vulnerability was named CVE-2012-4856. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.