Software supply chain security detection techniques must cover the software delivery life cycle, including software design, building, testing, and operation. There are mainly five types of security detection techniques, namely software composition analysis (SCA), static application security testing (SAST), dynamic application security testing (DAST), interactive application security testing (IAST), and...
Blog
GitLab Cross-Site Scripting (XSS) Vulnerability (CVE-2023-0050)
Overview Recently, NSFOCUS CERT found that GitLab has issued an official security notice to fix a cross-site scripting vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) (CVE-2023-0050). A remote attacker with low privileges can cause the client to store XSS through a specially crafted Kroki diagram, and finally...
NSFOCUS Included in Forrester Network Analysis and Visibility (NAV) Landscape
Santa Clara, Calif. March 03, 2023 – NSFOCUS, a global provider of intelligent hybrid security solutions, announced today that it has been included in Forrester’s recently published report, The Network Analysis and Visibility Landscape, Q1 2023. The report provides an overview of the market development, functions, and technologies of NAV...
NSFOCUS WAF Syslog Introduction
In computing, syslog is a standard for message logging. It allows separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, indicating the type of system generating the message, and is assigned...
ChatGPT Popularity Spurs Poisoning and Phishing Attacks
ChatGPT, the popular chat-based artificial intelligence platform, is becoming a target for malicious actors. Poisoning and phishing attacks are on the rise as more people use the platform for personal and business purposes. Poisoning Attack Targeting Open-Sourced ChatGPT Project A threat actor forked a very popular open-source ChatGPT desktop application...
Node.js Authentication Bypass Vulnerability (CVE-2023-23918) Notice
Overview Recently, NSFOCUS CERT detected that Node.js officially fixed an authentication vulnerability (CVE-2023-23918). Due to the flaw of improper permission control in Node.js, a remote attacker can use the process.mainModule.require() function to bypass permissions and access unauthorized modules. The official said that this vulnerability only affects users who have enabled...
