SQL injection vulnerability in Qixingchen Tianyue network security audit system (CNVD-2021-55197)

Providence Peak Network Security Audit System is a compliance management system for fine-grained auditing of users' operations on core IT assets and servers in the network under business environment. A SQL injection vulnerability exists in Tianyue Network Security Audit System, which can be...

Cisco BPA, WSA Bugs Allow Remote Cyberattacks

A set of high-severity privilege-escalation vulnerabilities affecting Business Process Automation BPA application and Cisco’s Web Security Appliance WSA and could allow authenticated, remote attackers to access sensitive data or take over a targeted system. The first two bugs CVE-2021-1574 and...

New SaaS Security Report Dives into the Concerns and Plans of CISOs in 2021

For years, security professionals have recognized the need to enhance SaaS security. However, the exponential adoption of Software-as-a-Service SaaS applications over 2020 turned slow-burning embers into a raging fire. Organizations manage anywhere from thirty-five to more than a hundred...

How to build a privacy program the right way

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with attorney Whitney Merrill, an expert on...

How to build a privacy program the right way

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with attorney Whitney Merrill, an expert on...

Introducing InsightCloudSec

A little over a year ago, when DivvyCloud first combined forces with Rapid7, I wrote that we did it because of culture, technology alignment, and the opportunity to drive even greater innovation in cloud security. Those core values remain true, and so does something else. As more organizations...

Compliance When Migrating to the Cloud: SQL Server Running on Azure vs. On- Premise

In the age of the data era, where data storage is increasing at an exponential rate and access to information is getting easier and faster, data security is a major concern. There are many cases where we can’t prevent people from accessing data, but we can track and investigate suspicious...

Why You’re Not Making the Leap from Compliance to a Database Security Strategy

Gartner strongly recommends that the concept of “big data strategy” should be replaced with “making big data part of our everyday strategy.” Technology has created a database activity explosion for most enterprises and made traditional agent-based data logging, monitoring, and auditing far too...

Google Cloud Platform Compliance Checks

Binary data gcpcompliancecheck.nbin...

3 Major Benefits of Cloud Migration: Cloud Compliance

Part of a secure cloud migration strategy is ensuring compliance of all the moving pieces. Just like your cloud journey, compliance isn’t a final destination. Discover how to leverage cloud security tools to ensure compliance is met along the way...

How DevOps can meet HIPAA compliance standards

Meet business compliance needs without interrupting your workflow...

SQL Injection Vulnerability in NetGuard Network Audit System of Beijing NetGuard Nebula Information Technology Co.

Netnifty Network Security Audit System is a compliance management system for fine-grained auditing of users' operational behavior on core IT assets and servers within the network in a business environment. A SQL injection vulnerability exists in the Netnifty Network Audit System of Beijing Netnif...

Critical VMware Carbon Black Bug Allows Auth Bypass

VMware has fixed an uber-severe bug in its Carbon Black App Control AppC management server: A server whose job is to lock down critical systems and servers so they don’t get changed willy-nilly. AppC also ensures that organizations stay in continuous compliance with regulatory mandates. This is a...

Reduce Business Risk By Fixing 3 Critical Endpoint-to-Cloud Security Requirements

Enterprise applications used to live securely in data centers and office employees connected to internal networks using company-managed laptops or desktops. And data was encircled by a walled perimeter to keep everything safe. All that changed in the last 18 months. Businesses and employees had t...

Return values of ERC20 transfer and transferFrom are unchecked

Handle shw Vulnerability details Impact In the contracts BadgerYieldSource and SushiYieldSource, the return values of ERC20 transfer and transferFrom are not checked to be true, which could be false if the transferred tokens are not ERC20-compliant e.g., BADGER. In that case, the transfer fails...

Huawei Data Communication: Configuring Community Name Complexity Check

If SNMPv1 and SNMPv2 are used, the community complexity check function must be enabled. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Strengthen Your Password Policy With GDPR Compliance

A solid password policy is the first line of defense for your corporate network. Protecting your systems from unauthorized users may sound easy on the surface, but it can actually be quite complicated. You have to balance password security with usability, while also following various regulatory...

Prove PCI DSS Compliance with Automation

Meet PCI DSS compliance needs without interrupting your workflow...

Fedora: Security Advisory for firefox (FEDORA-2021-af55f610eb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Attack Surface Analysis Part 2: Penetration Testing

In this three-part series, we’ll explore key considerations and strategies for choosing an attack surface analysis strategy, and the ways it can be used to increase awareness of both technical and process-related risks. This is the second installment in our 2021 series around attack surface...