cloud security, cloud frameworl, ci cd, build security

Kubernetes Security: Build Phase

Overview :

Kubernetes Security: Build Phase

Securing containers and Kubernetes starts within the building part with securing your container images. Your time spent right here pays dividends later due to the fact any neglected protection excellent practices at this factor may be considerably greater luxurious to restore down the line – as a result the phrase “shift left” which means enforcing protection at in advance ranges as images are built.

The two important things to work with this phase are to create secure images and to scan those images for any familiar vulnerabilities.

Maneesha Mariam
Read more
Container Security

Kubernetes Security – Introduction to Attack Vectors

Overview :

Kubernetes helps the enterprises to automate their application deployment for the business benefits. Now-a-days Kubernetes security can be considered as a critical component for all deployments because the new deployments might be vulnerable to attacks and exploits from hackers or insiders. Different kind of attacks will be launched against new container based virtualized environments. (in both private and public clouds.)

Maneesha Mariam
Read more

Multiple vulnerabilities reported in GitLab EE

Overview :
Multiple vulnerabilities reported in GitLab EE
Affected Product(s) :
  • Affected versions are >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
  • Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Vulnerability Details :
CVE ID : CVE-2020-13348
An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
CVE ID : CVE-2020-13349
An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Solution :

Rajaneesh
Read more

HTTP Prototype Pollution and CVE-2020-7703

Prototype Pollution

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype.

Maneesha Mariam
Read more

Jira – Open redirect vulnerability using os_destination

 
CVE-2019-20901
Proof of Concept :

The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.

Maneesha Mariam
Read more

Tracking Down New WordPress Popup Injection Malware

A new variant of popup injector WordPress malware is spreading and affecting 1000s of WordPress websites. The  web master was getting once in a weekly email from visitors complaining about adult content popups on the website.

Update – Contact security@prophaze.com to clean this variant and secure your website from similar attacks

Rajaneesh
Read more
cyber security news

PRTG-Network-Monitor-Information-Disclosure

 

Overview :
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.

CVE-2020-11547
Rajaneesh
Read more