FBI Warns of Egregor Attacks on Businesses Worldwide

The FBI has alerted companies in the private sector to a spate of attacks using the Egregor ransomware. The malware currently is raging a warpath across businesses worldwide and has already compromised more than 150 organizations. The agency issued an advisory PDF that also shed new light and...

CVE-2020-8280

A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting XSS attacks...

PT-2021-11948

Name of the Vulnerable Software and Affected Versions: Veritas Resiliency Platform versions 3.4 through 3.5 Description: An issue in the Veritas Resiliency Platform, which uses OpenSSL on Windows systems with the Managed Host addon, allows for arbitrary code execution as SYSTEM when the service...

The Evolution of Bad Bots from Grinchbots to Parasitic Bots-as-a-Service

The doomsday pandemic prediction is that you wont be able to buy toilet paper because bad bots will have hoarded all the inventory and are offering it to the highest bidder on secondary markets at an exorbitant mark-up. The Gaming Console War The use of scalping bots was once the domain of ticket...

Evaluating Our Core Principles

Reflecting on the past year led me to put together this post about how I believe this incredibly challenging year has had an irreversible effect on the way the workforce will collaborate, innovate, and do business in the future. The COVID-19 pandemic emerged at the beginning of 2020 and led to ne...

The Advantages and Risks of Serverless Computing

Organizations are increasingly embracing serverless computing for its convenience and cost-effectiveness. But many IT teams are blindly embracing this innovation in cloud technology without consulting their security peers. As a result, we can expect to see a growing number of cyber-attacks in thi...

Cloud is King: 9 Software Security Trends to Watch in 2021

IT security professionals have largely spent the year managing a once-in-a-generation workforce shift from office to home in 2020. With the initial push over, experts predict that 2021 will be focused on shoring up the cloud and re-imagining organizational workflows under this new normal. Softwar...

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in postgresql. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

SAP AS ABAP and SAP S4 HANA Improper Authentication Vulnerabilities

SAP Netweaver is a service-oriented, integrated application platform from SAP, which provides a development and runtime environment for SAP applications. The platform mainly provides development and operation environment for SAP applications.ABAP is an application server running in NetWeaver and...

Mount Locker Ransomware Offering Double Extortion Scheme to Other Hackers

A relatively new ransomware strain behind a series of breaches on corporate networks has developed new capabilities that allow it to broaden the scope of its targeting and evade security software—as well as with ability for its affiliates to launch double extortion attacks. The MountLocker...

CVE-2020-26826

Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file including script files without proper file format validation, leading to Unrestricted File Upload...

CVE-2020-26832

The CVE-2020-26832 issue affects SAP AS ABAP (SAP Landscape Transformation) and SAP S4 HANA (Landscape Transformation) with vulnerable versions: ABAP 2011_1_620/640/700/710/730/731/752 and S4 HANA 101–105. Root cause: missing authorization allows a high-privilege user to execute an RFC function m...

CVE-2020-26835

SAP NetWeaver AS ABAP (versions 740–754) is affected by a reflected XSS due to insufficient URL encoding, allowing an attacker to inject JavaScript via the URL and execute it in the browser. This is described in CNVD-2021-03703 and PT-2020-16518, which note the root cause as improper URL encoding...

CVE-2020-26826

CVE-2020-26826 affects SAP NetWeaver AS JAVA (Process Integration Monitoring) and is described across multiple sources as a vulnerability where an attacker can upload any file (including scripts) due to insufficient file format validation. Affected versions include SAP NetWeaver AS JAVA 7.31, 7.4...

CVE-2020-26829

SAP NetWeaver AS JAVA P2P Cluster Communication (versions 7.11–7.50) is affected by CVE-2020-26829 due to a missing authentication check, enabling an unauthenticated attacker to initiate privileged actions that are normally restricted to administrators, including access to system administration f...

CVE-2020-26816

The CVE-2020-26816 issue affects SAP NetWeaver AS Java Key Storage Service. Key material is stored in DER-encoded format in the database and is not encrypted, enabling an administrator to decode the keys and potentially access application data and client credentials of adjacent systems, impacting...

RUSTSEC-2020-0089 nanorand 0.5.0 - RNGs failed to generate properly for non-64-bit numbers

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the...

nanorand 0.5.0 - RNGs failed to generate properly for non-64-bit numbers

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the...

CVE-2020-26832: Missing Authorization

SAP AS ABAP SAP Landscape Transformation, versions - 20111620, 20111640, 20111700, 20111710, 20111730, 20111731, 20111752, 2020 and SAP S4 HANA SAP Landscape Transformation, versions - 101, 102, 103, 104, 105, allows a high privileged user to execute a RFC function module to which access should b...

PT-2020-16513

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA P2P Cluster Communication versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Description The issue allows arbitrary connections from processes outside the cluster and even outside the network segment dedicated for internal clust...