SANS 2021 Threat Hunting Survey: How Organizations' Security Postures Have Evolved in the New Normal

It's that time of year once again: The SANS Institute — the most trusted resource for cybersecurity research — has conducted its sixth annual Threat Hunting Survey, sponsored by Rapid7. The goal of this survey is to better understand the current threat hunting landscape and the benefits provided ...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5017-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5017-1 advisory. It was discovered that the virtual file system implementation in the Linux kernel contained an unsigned to signed integer conversion error. A...

The vulnerability of Moxa EDR-810 microcontroller software lies in the use and storage of the cryptographic key in an unencrypted form, allowing attackers to exploit their privileges.

The vulnerability of Moxa EDR-810 microcontroller-based software lies in the use and storage of the cryptographic key in an unencrypted form. Exploiting this vulnerability allows a remote attacker to gain increased privileges...

The vulnerability of Moxa EDR-810 microcontroller software-related microprogramming systems, due to problems with the use of cryptography, allows a perpetrator to gain access to confidential data.

The vulnerability of Moxa EDR-810 microcontroller software is related to issues with the use of cryptography. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data...

The vulnerability of Moxa EDR-810 microcontroller software, related to buffer overflow in the stack, allows a hacker to execute arbitrary code.

The vulnerability of Moxa EDR-810 microcontroller-based software is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Moxa EDR-810 microcontroller software lies in the lack of measures taken to neutralize special elements used in the OS command sequence, allowing a perpetrator to execute arbitrary code.

The vulnerability of Moxa EDR-810 microcontroller-based software relates to the lack of measures taken to neutralize special elements used in the OS command sequence. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

My thoughts on the “2021 Gartner Market Guide for Vulnerability Assessment”. What about the quality?

The Gartner Vulnerability Management Reports are one of the few marketing reports that I try to read regularly. This started back in the days when I was working for a VM vendor doing competitive analysis. Gartner is one of the few organizations that think about Vulnerability Assessment and...

SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2451-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2451-1 advisory. The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixe...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:2421-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2421-1 advisory. The SUSE Linux Enterprise 15 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were...

SUSE SLES12: kernel-default / kernel-default-base / kernel-default-devel / etc (SUSE-SU-2021:2406-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2406-1 advisory. The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

The Definitive RFP Templates for EDR/EPP and APT Protection

Advanced Persistent Threats groups were once considered a problem that concerns Fortune 100 companies only. However, the threat landscape of the recent years tells otherwise—in fact, every organization, regardless of vertical and size is at risk, whether as a direct target, supply chain or...

openSUSE 15 Security Update : bluez (openSUSE-SU-2021:2291-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2291-1 advisory. - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to...

SUSE SLED15 / SLES15 Security Update : bluez (SUSE-SU-2021:2291-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2291-1 advisory. - CVE-2021-0129,CVE-2020-26558: Check bluetooth security flags bsc1186463. Tenable has extracted the preceding description block...

FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles

A Cobalt Strike Beacon Object File BOF project which uses direct system calls to enumerate processes for specific modules or process handles. What is this repository for? Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules e.g. winhttp.dll,...

SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2021:2202-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2202-1 advisory. The SUSE Linux Enterprise 15 SP3 azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

McAfee MVISION EDR Command Injection Vulnerability

Mcafee McAfee MVISION EDR is an EDR product from Mcafee, Inc. that collects endpoint action logs and analyzes them with AI to detect malicious actions and take countermeasures. A command injection vulnerability exists in MVISION EDR that allows an authenticated MVEDR administrator to trigger an E...

CVE-2021-31838

A command injection vulnerability in MVISION EDR MVEDR prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'...

CVE-2021-31838

A command injection vulnerability in MVISION EDR MVEDR prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'...

CVE-2021-31838

A command injection vulnerability in MVISION EDR MVEDR prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'...

Command injection

A command injection vulnerability in MVISION EDR MVEDR prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'...