Rapid7 Source Code Accessed in Supply Chain Attack

Subscribe to Newsletters

More Informa Tech Live Events

White Papers

Hidden Costs of Endpoint Security

The Definitive Buyer’s Guide for Managed Threat Detection and Response Services

Tech Insights: Detecting and Preventing Insider Data Leaks

The Path to Successful Hyperautomation Starts With the Help Desk

Improve your business with a Virtual CISO

More White Papers

Video

All Videos

Cartoon

Post a Comment

Cartoon Archive

Current Issue

2021 Top Enterprise IT TrendsWe’ve identified the key trends that are poised to impact the IT landscape in 2021. Find out why they’re important and how they will affect you today!

Back Issues | Must Reads

Flash Poll

All Polls

How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.

Download Now!

Assessing Cybersecurity Risk in Today’s Enterprises

0 comments

The Malware Threat Landscape

0 comments

How Data Breaches Affect the Enterprise (2020)

0 comments

More Reports

Twitter Feed

Bug Report

Enterprise Vulnerabilities
From DHS/US-CERT’s National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15

A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.

CVE-2021-32073
PUBLISHED: 2021-05-15

DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.

CVE-2021-33033
PUBLISHED: 2021-05-14

The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.

CVE-2021-33034
PUBLISHED: 2021-05-14

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.

CVE-2019-25044
PUBLISHED: 2021-05-14

The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.

The post Rapid7 Source Code Accessed in Supply Chain Attack appeared first on Malware Devil.

https://malwaredevil.com/2021/05/14/rapid7-source-code-accessed-in-supply-chain-attack-2/?utm_source=rss&utm_medium=rss&utm_campaign=rapid7-source-code-accessed-in-supply-chain-attack-2