How purple teams can embrace hacker culture to improve security

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Matthew Hickey, co-founder, CEO, and writ...

How purple teams can embrace hacker culture to improve security

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Matthew Hickey, co-founder, CEO, and writ...

CISA Addresses the Rise in Ransomware Targeting Operational Technology Assets

CISA has published the Rising Ransomware Threat to OT Assets fact sheet in response to the recent increase in ransomware attacks targeting operational technology OT assets and control systems. The guidance: provides steps to prepare for, mitigate against, and respond to attacks; details how the...

What’s the difference between a CDN and a Web Accelerator❓

A Content Delivery Network CDN is a network of servers that deliver static assets to the end-user, while a Web Accelerator is another way of saying a CDN with a different name. The CDN is a network that has, as its primary function, optimizing access to content that is in demand, usually in the...

How Network Segmentation Simplifies PCI DSS Compliance

Read more about how proper network segmentation can simplify PCI DSS compliance by effectively reducing the number of assets in scope...

Becoming resilient by understanding cybersecurity risks: Part 4—navigating current threats

In part three of this blog series on aligning security with business objectives and risk, we explored what it takes for security leaders to shift from looking at their mission as purely defending against technical attacks, to one that focuses on protecting valuable business assets, data, and...

Becoming resilient by understanding cybersecurity risks: Part 4—navigating current threats

In part three of this blog series on aligning security with business objectives and risk, we explored what it takes for security leaders to shift from looking at their mission as purely defending against technical attacks, to one that focuses on protecting valuable business assets, data, and...

Payments paradigm shift

Crypto assets have been around for over a decade, and with the recent Coinbase IPO, we believe we are well past the point of calling this a "passing fad." In fact, we believe that crypto assets -- particularly bitcoin -- have now passed the tipping point from being considered an unconventional...

Introducing CyberSecurity Asset Management

With the rapid expansion of new IT technologies and their growing adoption rate, organizations face an increasing problem in securing their myriad on-premises, virtual & cloud-based assets. Add to that the explosion of intelligent devices on the corporate network and you have a huge landscape to...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. A cross-site scripting vulnerability exists in Liferay...

Patch Tuesday Dashboard Template Release

We know that many security teams rely on Microsoft’s patch cycle to remediate vulnerabilities in their environments. However, every month , Patch Tuesday introduces numerous vulnerabilities and their solutions that apply to many, if not nearly all, devices. Keeping up with the deployment of these...

Lack of chain information in the signed data leads to potential replay attacks.

Handle shw Vulnerability details Impact The Offer structure, whose hash is signed by a maker, does not contain information of the current chain. Therefore, the signature is valid on all EVM-compatible chains. In the situation of a future hard fork of the Ethereum network, the valid signatures on...

Tokens can be stolen through transferTo

Handle @cmichelio Vulnerability details Vulnerability Details I know that it's stated that: VADER, USDV, SYNTHS all employ the transferTo function, which interrogates for tx.origin and skips approvals. The author does not subscribe to the belief that this is dangerous In my opinion, it can be ver...

GitHub Missing Audit Logging

Original blog post here: https://wwws.nightwatchcybersecurity.com/2021/04/25/supply-chain-attacks-via-github-com-releases/ SUMMARY Release functionality on GitHub.com allows modification of assets within a release by any project collaborator. This can occur after the release is published, and...

About the security content of iOS 14.5 and iPadOS 14.5

About the security content of iOS 14.5 and iPadOS 14.5 This document describes the security content of iOS 14.5 and iPadOS 14.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

CVE-2021-29461

Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has...

Autodesk FBX Review Post-Release Reuse Vulnerability

Autodesk FBX Review is a lightweight standalone tool for viewing 3D assets and animations. A post-release reuse vulnerability exists in Autodesk FBX Review version 1.4.1.0. An attacker can exploit this vulnerability by tricking a user into opening a malicious FBX file to run arbitrary code on the...

CVE-2020-27240

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2021-11337 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.173.3 Description: An exploitable SQL injection issue exists in the getAssets.jsp page. The serialnumber parameter in this page is vulnerable to unauthenticated SQL injection. An attacker can trigger this issue by maki...

CVE-2020-27238

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...