Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-25878PUBLISHED: 2022-05-27
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.
This vulnerability can occur in multiple ways:
1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption ...
CVE-2021-27780PUBLISHED: 2022-05-27The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27781PUBLISHED: 2022-05-27The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2022-1897PUBLISHED: 2022-05-27Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-20666PUBLISHED: 2022-05-27
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
These vulnerabilities are due to insufficient va...
User Rank: Author
10/20/2014 | 3:29:06 PM
First, there's nothing you can do about it. High speed software development is happening and it's very unlikely that security can make it stop (not that you'd want to). If you try you will make yourself extremely unpopular and get marginalized. Ultimately, you'll end up hurting security by getting yourself cut out of the loop.
Second, these movements are a *massive* opportunity to do security better. These efforts are establishing the infrastructure necessary to do security at high-speed. Security folks just need to learn about the tools being used for software development -- tools like Jenkins, Sonar, JIRA, Puppet, and others are easy to leverage to do realtime application security at scale.
Try the free Contrast for Eclipse with your Java developers, and see what a huge difference *fast* can make. It really does change everything.
--Jeff