NotLegit: 4-year old Microsoft Azure App Service 0-day vulnerability affects source code repositories
A four-year old Microsoft Azure App Service 0-day vulnerability dubbed “NotLegit” affects hundreds of source code repositories.
Application Security
Researchers discover Critical RCE 0-day “Log4Shell” vulnerability (CVE-2021-44228) in Apache Log4j logging utility (update)
Researchers have discovered a Critical 0-day vulnerability (CVE-2021-44228) in Apache Log4j logging utility that can result in remote code execution (RCE). In addition, CISA and Microsoft also issue new guidance for log4j vulnerability remediation.
GitHub fixes 2 npm registry vulnerabilities
GitHub has fixed two node package manager (npm) registry vulnerabilities, one of those could allow an attacker to publish new versions of an npm package without proper authorization.
GoCD patches ‘Highly Critical’ authentication vulnerability
GoCD has patched a Critical authentication vulnerability in its GoCD CI/CD tool.
Embedded malware discovered in NPM package ua-parser-js
Embedded malware has been discovered in an NPM package ua-parser-js, a popular JavaScript library designed to detect browser, engine, OS, CPU, and device type/model from User-Agent data.
Malicious PyPI software packages found stealing payment card numbers and injecting code
Security researchers have discovered malicious software packages from Python’s official third party software package repository PyPl stealing payment card numbers and injecting code.
Attackers could have taken over an Atlassian account via one-click exploit
Cybersecurity researchers have discovered a series of chained Atlassian vulnerabilities that could have allowed an attacker to take over an Atlassian account connected via SSO and control Atlassian applications.
PHP user database leak allegedly led to PHP source code compromise
PHP maintainer Nikita Popov has published new details regarding the likely cause of a recent PHP source code compromise and insert of malicious code.
Microsoft open sources CodeQL queries to scan for Solarwinds-like Solorigate activity
Microsoft has open sourced CodeQL queries used to scan for Solorigate malware activity that matches the SolarWinds supply-chain attack.
Drupal patches Critical third-party library vulnerability (CVE-2020-36193)
Drupal has patched a Critical third-party library vulnerability (CVE-2020-36193) that affects multiple versions of Drupal Core.