CVE-2021-35957

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

CVE-2021-35957

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

Buffer overflow

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

CVE-2021-35957

CVE-2021-35957 affects Stormshield Endpoint Security Evolution 2.0.0–2.0.2. The issue is a local-privilege concern where an attacker with local access can replace Visual C++ runtime DLLs in %WINDIR%\system32 with malicious versions, undermining the intended defense. Root cause: insufficient prote...

CVE-2021-35957

Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs in %WINDIR%\system32 with malicious ones...

Stormshield Endpoint Security 安全漏洞

Stormshield Endpoint Security is a product line of enhanced workstation and server security from the French company Stormshield. A security vulnerability exists in Stormshield Endpoint Security, no information about this vulnerability is available at this time, please stay tuned to CNNVD or vendo...

Stormshield Endpoint Security 代码问题漏洞

Stormshield Endpoint Security is a product line for enhancing workstation and server security from the French company Stormshield. A security vulnerability exists in Stormshield Endpoint Security, which can be exploited to create a malicious EsScriptHost DLL that can be placed in the current...

Trend Micro Apex One 访问控制错误漏洞

Trend Micro Apex One is a suite of endpoint security protection software from Trend Micro that provides automated threat detection and response capabilities. An access control error vulnerability exists in Trend Micro Apex One. The vulnerability stems from incorrect privilege assignment. A local...

Why I Love (Breaking Into) Your Security Appliances

Amid the Colonial Pipeline and JBS ransomware attacks that sparked shockwaves among media worldwide, news broke that attackers were able to compromise Colonial Pipeline through a legacy VPN account. The account lacked multifactor authentication MFA and wasn’t in active use within the business, a...

PT-2021-5345

Name of the Vulnerable Software and Affected Versions ForgeRock Access Management AM Core Server versions prior to 7.0 ForgeRock OpenAM version 14.6.3 and earlier Description The issue is related to a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. This...

Improve your threat detection and response with Microsoft and Wortell

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. Learn more about MISA. The way of working is changing rapidly. Many workloads are moving to the cloud and the pandemic accelerated organizations to provide infrastructure to aid employees working from...

Improve your threat detection and response with Microsoft and Wortell

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. Learn more about MISA. The way of working is changing rapidly. Many workloads are moving to the cloud and the pandemic accelerated organizations to provide infrastructure to aid employees working from...

HackerOne: Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs

Hello, Hope you are doing well, SUMMARY -In hackerone user doesn't have permission to do any action like "disclosing/undiclosing" in disclosed report. -Here user can send the "cancel-disclosure-request" request to the server and server accepts the request gave 200ok response with ""flash":"The...

Understanding the threat landscape and risks of OT environments

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Chris Sistrunk, Technical Manager in...

Microsoft is a Leader in the 2021 Forrester Endpoint Security Software as a Service Wave

We are excited to share that Microsoft has been named a Leader in The Forrester Wave: Endpoint Security Software as a Service, Q2 20211, receiving one of the highest scores in the strategy category and among the top three scores in the current offering category. Forrester notes that “the focus on...

Microsoft is a Leader in the 2021 Forrester Endpoint Security Software as a Service Wave

We are excited to share that Microsoft has been named a Leader in The Forrester Wave: Endpoint Security Software as a Service, Q2 20211, receiving one of the highest scores in the strategy category and among the top three scores in the current offering category. Forrester notes that “the focus on...

CVE-2021-3485

CVE-2021-3485 affects Bitdefender Endpoint Security Tools for Linux prior to 6.2.21.155. An Improper Input Validation in the Product Update feature allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. Remediation: update to...

CVE-2021-3485 Improper Input Validation in Bitdefender Endpoint Security Tools for Linux

An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Securit...

PT-2021-20696 · Bitdefender · Bitdefender Endpoint Security Tools For Linux

Name of the Vulnerable Software and Affected Versions: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155 Description: An Improper Input Validation issue in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to...

Bitdefender Endpoint Security Tool 输入验证错误漏洞

Bitdefender Endpoint Security Tool is an endpoint security management tool from the Romanian company Bitdefender. An input validation error vulnerability exists in Product Update for Linux Bitdefender Endpoint Security Tools versions prior to 6.2.21.155, which can be exploited by an attacker to...