Common Security Misconfigurations and Their Consequences

Everyone makes mistakes. That one sentence was drummed into me in my very first job in tech, and it has held true since then. In the cybersecurity world, misconfigurations can create exploitable issues that can haunt us later - so let's look at a few common security misconfigurations. The first o...

CVE-2020-26177

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

CVE-2020-26174

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser client-side and can be circumvented. This allows an attacker to upload any file as an...

FreeBSD FTPD Improper Handling of Exceptional Conditions Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of FreeBSD FTPD. Authentication is required to exploit this vulnerability. The specific flaw exists within the enforcement of permissions. The process does not properly handle exceptional conditions. An...

Defending the Intelligent Edge from Evolving Attacks

Cybercriminals keep their fingers on the pulse of potential new attack vectors at all times, looking for their next opportunity. They are currently moving significant resources to target and exploit emerging network-edge environments, such as the cloud and remote workers, rather than just targeti...

Insufficient Policy Enforcement

Google Chrome has insufficient policy enforcement. An attacker could access content on the local file system via a crafted Chrome Extension...

Cayman Islands Bank Records Exposed in Open Azure Blob

A Cayman Island investment firm has removed years of backups, which up until recently were easily available online thanks to a misconfigured Microsoft Azure blob. The blob’s single URL led to vast stores of files including personal banking information, passport data and even online banking PINs —...

openSUSE Security Update : chromium (openSUSE-2020-2032)

This update for chromium fixes the following issues : - Update to 87.0.4280.66 boo1178923 - Wayland support by default - CVE-2020-16018: Use after free in payments. - CVE-2020-16019: Inappropriate implementation in filesystem. - CVE-2020-16020: Inappropriate implementation in cryptohome. -...

Cybersecurity Predictions for 2021: Robot Overlords No, Connected Car Hacks Yes

Predicting the future is always an iffy proposition. There’s the Nostradamus route, making predictions so cryptic and vague they could mean just about anything. Or you can go the TV psychic route and throw a handful of darts at the wall, highlighting the ones that stick and hope everyone ignores...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2020:2026-1 Rating: important References: 1178923 Cross-References: CVE-2019-8075 CVE-2020-16012 CVE-2020-16014 CVE-2020-16015 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2020:2055-1 Rating: important References: 1178923 Cross-References: CVE-2019-8075 CVE-2020-16012 CVE-2020-16014 CVE-2020-16015 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022...

OPENSUSE-SU-2020:2021-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 87.0.4280.66 boo1178923 - Wayland support by default - CVE-2020-16018: Use after free in payments. - CVE-2020-16019: Inappropriate implementation in filesystem. - CVE-2020-16020: Inappropriate implementation in cryptohome. -...

OPENSUSE-SU-2020:2012-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 87.0.4280.66 boo1178923 - Wayland support by default - CVE-2020-16018: Use after free in payments. - CVE-2020-16019: Inappropriate implementation in filesystem. - CVE-2020-16020: Inappropriate implementation in cryptohome. -...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2020:2010-1 Rating: important References: 1178923 Cross-References: CVE-2019-8075 CVE-2020-16012 CVE-2020-16014 CVE-2020-16015 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022...

3 Ways to Hunt for the ZeroLogon Vulnerability on Your Windows Servers

Vulnerability assessment and patch management can be painful time-consuming processes. From the Security team looking at vulnerability reports and prioritizing the riskiest ones for their environment to the IT or Infrastructure team determining exactly which machines need to be patched and...

LAPD Bans Facial Recognition, Citing Privacy Concerns

The Los Angeles Police Department LAPD has banned the use of commercial facial-recognition services – citing “public trust” considerations. The move comes in the wake of a report that showed that more than 25 employees of the department had performed 475 searches so far using the Clearview AI, an...

CVE-2020-16027

Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension...

CVE-2020-16022

Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page...

Google Chrome Security Vulnerability

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in versions prior to Google chrome 87.0.4280.66, which stems from a policy enforcement security insufficiency found in the developer tools component...

Google Chrome Security Vulnerability

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in versions prior to Google chrome 87.0.4280.66, which stems from insufficient policy enforcement in the network...