Collaborate Disseminate
I am looking at this vulnerability: CVE-2019-0231
The NVD description says:
Handling of the close_notify SSL/TLS message does not lead to a
connection closure, leading the server to retain the socket opened and
to have the client potentia… Continue reading why CVE-2019-0231 is critical? [closed]
I am looking at this CVE: https://nvd.nist.gov/vuln/detail/CVE-2021-22044
The description says:
In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to
2.2.9.RELEASE, and older unsupported versions, applications using type-level @Reque… Continue reading how is CVE-2021-22044 risky
Been having some issues lately with Snyk. I’ve reached out to support but there’s a bit of a delay (like 48hr plus) so I’m looking to see if someone else has experienced this and if they’ve had a fix.
Branch protection enabled on GH enterp… Continue reading Issues with Snyk x GitHub Enterprise Branch Protection [closed]
Nuclei is a fast and customizable open-source vulnerability scanner powered by YAML-based templates. With its flexible templating system, Nuclei can be adapted to perform various security checks. It can send requests to multiple targets using customiza… Continue reading Nuclei: Open-source vulnerability scanner
Forescout has published a new report examining the current state of the software supply chain in OT/IoT routers. The study uncovered that OT and IoT cellular routers and those used in small offices and homes contain outdated software components associa… Continue reading OpenWrt dominates, but vulnerabilities persist in OT/IoT router firmware
The National Institute of Standards and Technology (NIST) has awarded a contract for an unnamed company/organization to help them process incoming Common Vulnerabilities and Exposures (CVEs) for inclusion in the National Vulnerability Database (NVD), t… Continue reading NIST says NVD will be back on track by September 2024
The University of Erlangen-Nuremberg (Germany) is conducting a research study to investigate the consistency of CVSSv4 (Common Vulnerability Scoring System). If you are currently assessing vulnerabilities using CVSS, we would greatly appre… Continue reading How consistent are CVSSv4 scores? [closed]
The University of Erlangen-Nuremberg (Germany) is conducting a research study to investigate the consistency of CVSSv4 (Common Vulnerability Scoring System). If you are currently assessing vulnerabilities using CVSS, we would greatly appre… Continue reading How consistent are CVSSv4 scores? [closed]
The US Cybersecurity and Infrastructure Agency (CISA) has announced the creation of “Vulnrichment,” a new project that aims to fill the CVE enrichment gap created by NIST National Vulnerability Database’s recent slowdown. NVD is faili… Continue reading CISA starts CVE “vulnrichment” program
I am running a pentest on a web application, and I detected a vulnerability but I am not sure how to report it. I am confused if I should split it or document it as 1 finding. I will explain below.
So the finding is, a JWT token with large… Continue reading How to report related findings in a pentest report