Virtual Hackathon Generates Next Generation of Imperva Innovation

“How do we run a global hackathon amid a global pandemic?” That was my first thought when I began planning the 2020 Imperva Hackathon earlier this year. While the event is designed to foster innovation and uncover new ideas, in a global company like ours it’s also about making new friends and...

Distinguishing Among DNS Services Part 1: The Platform

This is Part 1 of a 3-part blog series highlighting some of the distinguishing aspects of Akamai's DNS services, Edge DNS and Global Traffic Management...

Potential privilege escalation in Ops Manager API

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions 4.2.0-4.2.17, v4.3 versions 4.3.0-4.3.9 and v4.4 versions 4.4.0-4.4.2...

The vulnerability of the Security component of the PeopleSoft Enterprise HCM Global Payroll Core application allows a perpetrator to gain unauthorized access to protected information, to modify, add, or delete data, or to cause service interruptions.

The vulnerability of the Security component of the PeopleSoft Enterprise HCM Global Payroll Core application is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information, to modif...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

CVE-2020-7927 Potential privilege escalation in Ops Manager API

Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions prior to and including 4.2.17, MongoDB Ops Manager v4.3 versions prior to and including 4.3.9 an...

MongoDB Ops Manager Authorization Issues Vulnerability

MongoDB Ops Manager is a solution from MongoDB, Inc. that supports the management, monitoring, and backup of MongoDB deployments. An authorization issue vulnerability exists in MongoDB Ops Manager that stems from a specially designed API call that could allow an authenticated user holding...

Debian DLA-2463-1 : samba security update

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. CVE-2020-1472 Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations. CVE-2020-10704 An...

PT-2020-19852 · Mongodb · Mongodb Ops Manager

Name of the Vulnerable Software and Affected Versions: MongoDB Ops Manager versions prior to and including 4.2.17 MongoDB Ops Manager versions prior to and including 4.3.9 MongoDB Ops Manager versions prior to and including 4.4.2 Description: Specially crafted API calls may allow an authenticated...

CVE-2020-4006

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Recent assessments: ccondon-r7 at December 10, 2020 7:54pm UTC reported: I’ve seen some news headlines with very scary-sounding words “ransacking...

Modernize secure access for your on-premises resources with Zero Trust

Change came quickly in 2020. More likely than not, a big chunk of your workforce has been forced into remote access. And with remote work came an explosion of bring-your-own-device BYOD scenarios, requiring your organization to extend the bounds of your network to include the entire internet and...

Akamai's Technical Enablement and Education Team, Part of the Global Services and Support Organization, Wins Four Gold, Silver, and Bronze "Excellence in Education" Awards

Akamai's Technical Enablement and Education Team won four coveted Brandon Hall Group awards for excellence in learning. Akamai's win was announced on August 20, 2020. The winners are listed on Brandon Hall Group's website. The award-winning team is responsible for creating product training and...

Evolution of Emotet: From Banking Trojan to Malware Distributor

Emotet is one of the most dangerous and widespread malware threats active today. Ever since its discovery in 2014—when Emotet was a standard credential stealer and banking Trojan, the malware has evolved into a modular, polymorphic platform for distributing other kinds of computer viruses. Being...

Unauthorized Access Vulnerability in PAX Management System V1.0 Login Page of Billion Global Technology Ltd.

PAX GLOBAL TECHNOLOGY LIMITED PAX GLOBAL TECHNOLOGY is a leading international provider of secure electronic payment terminal hardware and transaction software services. An unauthorized access vulnerability exists in the PAX GLOBAL TECHNOLOGY LIMITED PAX Management System V1.0 login page, which c...

ThreatList: Pharma Mobile Phishing Attacks Turn to Malware

As pharmaceutical companies such as Pfizer race to develop a vaccine for COVID-19, mobile phishing gangs are swapping up their tactics in hopes to get their hands on critical research. Cybercriminals previously targeted pharmaceutical company employee credentials. However, new research shows that...

COVID-19 Antigen Firm Hit by Malware Attack

Over the past two weeks, global biotech firm Miltenyi has been battling a malware attack on its IT infrastructure, the company said in a recent disclosure to its customers. Miltenyi, which has been working on treatments for COVID-19, is still wrestling with phone and email communications in the...

OSV-2020-2158 Global-buffer-overflow in arrow::Status arrow::internal::ValidateArrayFullImpl::ValidateListLike<arrow::Li

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27475 Crash type: Global-buffer-overflow READ 4 Crash state: arrow::Status arrow::internal::ValidateArrayFullImpl::ValidateListLikearrow::Li arrow::internal::ValidateArrayFullImpl::ValidateWithType...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the ISC² Security Congress 2020, November 16, 2020. I’ll be on a panel at the OECD Global Blockchain Policy Forum 2020 on November 17, 2020. The panel is called "Deep Dive: Digital Security and Distributed Ledger...