API - API Security Blog

FUD-UUID-Shellcode – Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness

[![](https://blogger.googleusercontent.com/img/a/AVvXsEiOoS9-KAM1wjbweAaKJkoRz3eRYelIMOxkWtHgmYbaBjijf3Wb9j25ANPxkZ2dP9cki8QuvWkYkh2Fle5EPvBhi1ibG68a6ab7Vx6X73n9ARCY0MbmQCUbLnMnfFyoj33ouIGiPzaD9X73mdc ...

October 13, 2022

New Timing Attack Against NPM Registry API Could Expose Private Packages

[![Private NPM Packages](https://thehackernews.com/new-images/img/b/R29vZ2xl/AVvXsEhRbRwj5640GFnhBdC7HwA7MdKVf985l49-Ru5KkihVPBaD3wangueCf76HZwu_8bNOJ02cgF3ORhvB4zFzPhdQHT14vS8RE6xCWAj69CPqGbgETs2A-Zp ...

October 13, 2022

Not Your Average FIM: Why Customers Choose Qualys FIM

Choosing the right FIM solution is a crucial step for an organization. One should not need professional services just to onboard or manage. Traditional FIM solutions with legacy architecture are eithe ...

October 13, 2022

CVE-2022-2828

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerabilityRead More ...

October 13, 2022

Exploit for CVE-2022-2992

# CVE-2022-2992 Authenticated Remote Command Execution in Gitlab...Read More ...

October 13, 2022

Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer (important)

An update that fixes two vulnerabilities is now available. Description: This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues: Changes in gdcm: - rename ...

October 12, 2022

CVSS3 - CRITICAL

CVSS2 - HIGH

Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer (important)

An update that fixes two vulnerabilities is now available. Description: This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues: Changes in gdcm: - Provid ...

October 12, 2022

CVSS3 - CRITICAL

CVSS2 - HIGH

com.enonic.xp:lib-auth vulnerable to Session Fixation

### Impact All id-providers using lib-auth `login` method. lib-auth should invalidate old session after login and replicate session attributes in a new one, however this is not the behavior in affecte ...

October 12, 2022