4647 matches found
How Microsoft tools and partners support GDPR compliance
This post is authored by Daniel Grabski,Executive Security Advisor, Microsoft Enterprise Cybersecurity Group. As an Executive Security Advisor for enterprises in Europe and the Middle East, I regularly engage with Chief Information Security Officers CISOs, Chief Information Officers CIOs and Data...
Wazuh - Open Source Host and Endpoint Security
Wazuh helps you to gain deeper security visibility into your infrastructure by monitoring hosts at an operating system and application level. This solution, based on lightweight multi-platform agents, provides the following capabilities: Log management and analysis: Wazuh agents read operating...
onthesnow.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-453623 Description| Value ---|--- Affected Website:| onthesnow.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...
CVE-2017-14380
In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin compadmin account user could exploit a vulnerability in isigetitrace or isigetprofile maintenance scripts to run any shell script as system root on a cluster in...
CVE-2017-14380
In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin compadmin account user could exploit a vulnerability in isigetitrace or isigetprofile maintenance scripts to run any shell script as system root on a cluster in...
Privilege escalation
In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin compadmin account user could exploit a vulnerability in isigetitrace or isigetprofile maintenance scripts to run any shell script as system root on a cluster in...
CVE-2017-14380
EMC Isilon OneFS is affected by CVE-2017-14380, impacting versions 8.1.0.0; 8.0.1.0–8.0.1.1; 8.0.0.0–8.0.0.4; 7.2.1.0–7.2.1.5; 7.2.0.x; and 7.1.1.x. A malicious compadmin user can exploit a vulnerability in isi_get_itrace or isi_get_profile maintenance scripts to run any shell script as system ro...
CVE-2017-14380
In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin compadmin account user could exploit a vulnerability in isigetitrace or isigetprofile maintenance scripts to run any shell script as system root on a cluster in...
Deploying and Troubleshooting Compliance Baselines
If you are in the IT space, youve most likely encountered or are bound by some form of regulation/framework such as PCI, HIPAA, FISMA, and/or CGIS. Most of these compliance programs require a hardened baseline to be implemented within your information systems to reduce the risk and impact of an...
[SECURITY] Fedora 27 Update: firefox-57.0.1-1.fc27
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
[SECURITY] Fedora 26 Update: firefox-57.0.1-1.fc26
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...
SUSE-SU-2017:3230-1 Security update for openssh
This update for openssh fixes the following issues: Security issue fixed: - CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server bsc1065000. Bug fixes: - FIPS: Startup selfchecks bsc1068310. - FIPS: Silent complaints about unsupported key exchange methods bsc1006166. -...
Data Masking 101 – Whiteboard Wednesday [Video]
Data masking is an effective way to protect a large majority of your organization’s data. It replaces original data with realistic, but fictional data—reducing production data sprawl and your attack surface footprint, while maintaining the data's use for things like development, analytics modelin...
Implementing the CIS 20 Critical Security Controls: Delving into More Sophisticated Techniques
Corden Pharma needed a standardized security program to meet customer requirements. Link3 Technologies wanted to prioritize its network security improvements. Telenet was looking for a road map to implement its ISO-27000 compliance program. These three companies — a German pharmaceutical contract...
Qualys Cloud Platform 8.11.2 New Features
This new patch release of the Qualys Cloud Platform, version 8.11.2, includes updates to shared platform features, Qualys Vulnerability Management and Qualys Policy Compliance SCAP scanning. Update 12/1/2017: New Vulnerability Management feature added below. Feature Highlights Cloud Platform User...
Implementing the CIS 20 Critical Security Controls: Building Upon Foundational Cyber Hygiene
Most successful cyber attacks exploit known vulnerabilities for which patches are available, or take advantage of weak configuration settings that could have been easily hardened. You can significantly lower the risk of being victimized by this type of common, preventable attack by adopting the...
Australia’s “Essential Eight” is Critical to Meet 2018 Cybersecurity Mandates & Privacy Laws
Christopher Strand, Carbon Black’s security risk and compliance officer recently wrote a blog discussing how the new mandatory data breach notification rule in the Privacy Amendment Notifiable Data Breaches Bill 2016, helps bring attention to cybersecurity solutions and focus on the practices...
Trend Micro Protects VMware on Amazon Web Services
Organizations are taking advantage of changes in computing technology to position themselves for a more agile future. Technology leaders and architects see value beyond the data center with new public cloud models and are keen on adopting hybrid infrastructure approaches to their compute...
Tinysvcmdns Multi-label DNS Heap Overflow Vulnerability
Summary An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this...