Key Technologies for Software Supply Chain Security – Detection Techniques (Part 1) – Software Composition Analysis

março 6, 2023

Software supply chain security detection techniques must cover the software delivery life cycle, including software design, building, testing, and operation. There are mainly five types of security detection techniques, namely software composition analysis (SCA), static application security testing (SAST), dynamic application security testing (DAST), interactive application security testing (IAST), and FUZZ testing. Each of these […]

GitLab Cross-Site Scripting (XSS) Vulnerability (CVE-2023-0050)

março 5, 2023

Overview Recently, NSFOCUS CERT found that GitLab has issued an official security notice to fix a cross-site scripting vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) (CVE-2023-0050). A remote attacker with low privileges can cause the client to store XSS through a specially crafted Kroki diagram, and finally perform arbitrary operations on the […]

NSFOCUS Included in Forrester Network Analysis and Visibility (NAV) Landscape

março 3, 2023

Santa Clara, Calif. March 03, 2023 – NSFOCUS, a global provider of intelligent hybrid security solutions, announced today that it has been included in Forrester’s recently published report, The Network Analysis and Visibility Landscape, Q1 2023. The report provides an overview of the market development, functions, and technologies of NAV products in detail. As one […]

NSFOCUS WAF Syslog Introduction

março 3, 2023

In computing, syslog is a standard for message logging.  It allows separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, indicating the type of system generating the message, and is assigned a severity level. Computer system […]

ChatGPT Popularity Spurs Poisoning and Phishing Attacks

março 2, 2023

ChatGPT, the popular chat-based artificial intelligence platform, is becoming a target for malicious actors. Poisoning and phishing attacks are on the rise as more people use the platform for personal and business purposes. Poisoning Attack Targeting Open-Sourced ChatGPT Project A threat actor forked a very popular open-source ChatGPT desktop application project and implanted a data-stealing […]

Node.js Authentication Bypass Vulnerability (CVE-2023-23918) Notice

março 1, 2023

Overview Recently, NSFOCUS CERT detected that Node.js officially fixed an authentication vulnerability (CVE-2023-23918). Due to the flaw of improper permission control in Node.js, a remote attacker can use the process.mainModule.require() function to bypass permissions and access unauthorized modules. The official said that this vulnerability only affects users who have enabled the experimental permission option –experimental-policy. […]

Multiple Security Vulnerabilities in Google Chrome

fevereiro 28, 2023

Overview Recently, NSFOCUS CERT detected that Google Chrome officially released a security bulletin, which fixed multiple security vulnerabilities. The key vulnerabilities are as follows: Google Chrome use-after-free vulnerability (CVE-2023-0927): Due to a use-after-free flaw in the Web Payments API in Google Chrome, a remote attacker capable of compromising the renderer process could exploit a heap […]

VMware Carbon Black App Control Remote Code Execution Vulnerability (CVE-2023-20858) Notification

fevereiro 27, 2023

Overview Recently, NSFOCUS CERT found that VMware has officially fixed an App Control injection vulnerability (CVE-2023-20858). Due to flaws in product verification of user-input content, attackers with App Control management console permissions can access the underlying server operating system by entering specially crafted data, and ultimately achieve arbitrary code execution on the target system. The […]

Joomla Unauthorized Access Vulnerability (CVE-2023-23752) Notice

fevereiro 24, 2023

Overview Recently, Joomla officially released a security update notice to fix a Joomla unauthorized access vulnerability (CVE-2023-23752), which was submitted by a researcher of NSFOCUS Tianji Lab. Due to flaws in Joomla’s access control to Web service endpoints, unauthenticated attackers access the RestAPI interface to obtain Joomla-related configuration information by constructing specially crafted requests, which […]

ESXiArgs Ransomware Attack Event Analysis

fevereiro 23, 2023

The French Computer Emergency Response Team (CERT-FR) warned that [1] an attacker exploited a two-year-old remote code execution vulnerability in VMware ESXi server to deploy new ESXiArgs ransomware. The security vulnerability number is CVE-2021-21974 [2] and it is caused by a heap overflow vulnerability in the OpenSLP service. Unauthenticated attackers can use this vulnerability to […]


Inscreva-se no Blog da NSFOCUS