Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-25878PUBLISHED: 2022-05-27
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.
This vulnerability can occur in multiple ways:
1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption ...
CVE-2021-27780PUBLISHED: 2022-05-27The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
CVE-2021-27781PUBLISHED: 2022-05-27The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
CVE-2022-1897PUBLISHED: 2022-05-27Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
CVE-2022-20666PUBLISHED: 2022-05-27
Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
These vulnerabilities are due to insufficient va...
User Rank: Ninja
7/26/2019 | 8:33:17 PM
I remember reading an article from DR that talked about combining "IT Security" with "DevOps" to create a "SecDev" or "DevSec" group. I think in this particular case, this is a good use case where the security teams can get involved in the security design aspects and make suggestions as to how to utilize existing tools from operations:
We are seeing more of this, Louisiana is under a state of emergency (schools are being plummeted by various cyber actors), by working with various groups from different regions of the US, we can start coming up with better ways of addressing this cyber issue. A number of companies are doing a good job to help, it just depends on your budget, but if you have good people on staff, it may not have to cost the organization anything but labor cost.
Just a thought.
T