4648 matches found
CVE-2017-1177
IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123429...
CVE-2017-1198
CVE-2017-1198 affects IBM BigFix Compliance 1.7–1.9.91 (TEMA SUAv1 SCA SCM). The underlying issue is that sensitive information is stored in URL parameters, enabling potential information disclosure if URLs are exposed in server logs, referrer headers, or browser history. The NVD entry notes expl...
CVE-2017-1200
IBM BigFix Compliance 1.7 through 1.9.91 TEMA SUAv1 SCA SCM does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. The software might connect to a malicious host while believing it is a...
Keys to Safeguarding Consumer Data in 2019
Businesses and providers typically collect certain details from their customers in order to support service delivery. This information has always been a top target for hackers, but given the high level and rising sophistication of threats, it's more imperative than ever to ensure it's protected...
[SECURITY] Fedora 28 Update: firefox-65.0-1.fc28
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
Airbus Data Takes Flight; and Billions of Credentials Dumped on Dark Web
French airplane and military aircraft behemoth Airbus SE has become the latest victim of a cyberattack leading to a data breach, with an incident detected on its “commercial aircraft business” information systems. It is only the latest high-profile data exposure to come to light in recent days, a...
[SECURITY] Fedora 29 Update: firefox-65.0-1.fc29
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
The HOW, WHY, and HUH? Blog on Disputes
As you may know, performing vulnerability scans is a requirement for PCI DSS compliance. One of those specific requirements, described in section 11.2.2, states that quarterly external scanning must be done by a qualified Approved Scanning Vendor. Coalfire just so happens to be an ASV, so if you...
Policy Compliance Adds UDC Support for Cloud Agent
Qualys is extending the Cloud Agent capabilities for users of the Policy Compliance PC application by letting them define controls. Until now, the Cloud Agent could only assess Qualys PC’s “out of the box” controls. By adding support for user defined controls UDC, Qualys PC users now can use Clou...
Qualys Cloud Platform (VM, PC) 8.17 New Features
Qualys Cloud Platform VM, PC version 8.17 contains various feature enhancements in Qualys Vulnerability Management and Qualys Policy Compliance. In addition, this release also lowers the time required before pausing or canceling an ongoing scan. Previously, scheduled scans could be cancelled or...
Securing Social / Locking Login / Armoring Authentication
Authentication might be the single biggest hazard for web security over the next decade. It's not that the fundamentals of authentication are particularly challenging; we've understood the basic principles behind password management, push-based authorization, and device certificates for some time...
Linux: Log non-standard ICMP messages
To reduce logfile size, it is possible to ignore ICMP messages that do not match standards. This script tests whether the Linux host is configured to ignore non-standard ICMP messages. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...
Qualys Cloud Platform (VM, PC) 8.16 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.16, contains several new improvements in Qualys Vulnerability Management and Qualys Policy Compliance, which includes new password security option, increased limit for virtual hosts that can be added to a subscription, added support...
Qualys Policy Compliance Notification: Policy Library Update
Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...
Linux: Separate partition for /var/log/audit directory
The /var/log/audit directory is used by auditd. This script tests options set on /var/log/audit filesystem. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General...
Two new Microsoft 365 offerings help address security and compliance needs
Today, were introducing two new offerings to help address the security and compliance needs in an age of increasingly sophisticated cybersecurity threats as well as complex information protection needs due to regulations like GDPR. The new Identity & Threat Protection and Information Protection &...
New Advanced Dynamic Scan Policy Template in Nessus 8
According to Nessus 8.1.0 release notes, Tenable finally solved the problem with Mixed Plugin groups. At least partially. I will briefly describe the problem. Let's say we found out that some Nessus plugins crash our target systems. This happens rarely, but it happens. So, we decided to disable...
The Year Ahead: Cybersecurity Trends To Look Out for In 2019
A Proven Record Tracking Cybersecurity Trends This time of the year is always exciting for us, as we get to take a step back, analyze how we did throughout the year, and look ahead at what the coming year will bring. Taking full advantage of our team’s expertise in data and application security,...
App Security and PCI; Are you ready for the audit?
As most people know, merchants, financial institutions and anybody else who is involved in processing credit cards are subject to the PCI DSS compliance to reduce fraud and cybersecurity risks. This affects both brick-n-mortar stores and banks as well as card-not-present CNP transactions that...