In the Dark about Software Supply Chain Vulnerabilities
2 minute read time
The Barium attacks, revealed earlier this month, highlight new, pervasive tactics that are exceptionally dangerous.
Read More...
Nexus Intelligence Insights: CVE-2019-0232 - Apache Tomcat CGI Servlet Remote Code Execution
3 minute read time
Learn about a very popular component used by developers worldwide. Say hello to CVE-2019-0232, a remote code execution vulnerability.
Read More...
Malicious Attacks On Open Source Are Going to Get Worse: Developers Need to Take Notice
2 minute read time
Bad actors have recognized the power of open source and are now beginning to create their own attack opportunities.
Read More...
Corrupting the Software Supply Chain: Lessons From the Bootstrap-sass Hack
2 minute read time
The boldness of bad actors is escalating in the world of open source software. From the event-stream / NPM incident in November of 2018, to the recent bootstrap-sass / Ruby Gems hack, bad actors are
Read More...
Nexus Intelligence Insights: CVE-2014-3483 - SQL Injection in PostgreSQL adapter for Active Record against 'range' data type
3 minute read time
In this month's Nexus Intelligence Insights we discuss an older component that is used by millions of developers.
Read More...
Nexus Intelligence Insights: CVE-2014-3603 — Lack of Hostname Verification in OpenSAML
3 minute read time
In this month's Nexus Intelligence Insights we discuss an older component, but one that is widely used across a variety of ecosystems, and has a vulnerability.
Read More...
Vor Security brings OSS Index to Sonatype
2 minute read time
Vor Security acquisition, extended language coverage, ossindex.net
Read More...
Struts2 Exploited Again. Did Anyone Bother to Tell You?
5 minute read time
This week I woke up to find several emails from Nexus Lifecycle indicating that the products in my portfolio were potentially vulnerable due to their.
Read More...
Did You Wake Up to an Alert About the Java Deserialization Vulnerability?
4 minute read time
This week I woke up to find several emails from Nexus Lifecycle indicating that the products in my portfolio were potentially vulnerable due to their.
Read More...