CVE-2020-6221

The CVE-2020-6221 issue affects SAP Business Objects Business Intelligence Platform, specifically the Web Intelligence HTML interface, versions 4.1 and 4.2. The root cause is insufficient encoding of user-controlled inputs, leading to Cross-Site Scripting (XSS). The connected documents consistent...

CVE-2020-6223

The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pages to include malicious content. This can misdirect a user who is tricked into accessing these error pages rendered by the application, leading to Content...

CVE-2020-6218

Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure...

Why CISOs Are Demanding Detection and Response Everywhere

Over the past three decades, we’ve had time at Trend Micro to observe the industry trends that have the biggest impact on our customers. And one of the big things we’ve seen is that threats move largely in tandem with changes to IT infrastructure. This matters today because most organizations are...

PT-2020-2531 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 5.5.0.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient access control in the Analytics Web General component of Oracle Business Intelligence Enterprise Edition...

Afternoon Cyber Tea: Building operational resilience in a digital world

Operational resiliency is a topic of rising importance in the security community. Unplanned events, much like the one we are facing today, are reminders of how organizations can be prepared to respond to a cyberattack. Ian Coldwater and I explored a variety of options in my episode of Afternoon...

Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two

One of the critical strategic and tactical roles that cyber threat intelligence CTI plays is in the tracking, analysis, and prioritization of software vulnerabilities that could potentially put an organization’s data, employees and customers at risk. In this four-part blog series, FireEye Mandian...

Imperva is a Leader in the Forrester Wave: Web Application Firewalls, Q1

Web application firewalls continue to be a core technology function for securing critical assets, and for IT professionals, market analyst reports and validation are critical when deciding upon new WAF solutions. That’s why we’re proud to share that Imperva Cloud WAF has recently been recognized ...

The Results Are In: Defender Confidence Is On The Rise

Recently, I spent two weeks traveling across Europe talking with defenders, reporters, and leaders of security programs. While each country faces its own unique challenges and has its own needs, there were a few themes that were consistently present. Threat Outlook Report 2020. Naturally, we...

Business Continuity and Security in an Uncertain Global Environment

The need for companies to quickly enable remote access to business-critical applications was highlighted in a recent Akamai blog -- Enabling Business Continuity in an Uncertain Global Environment. However, despite the current environment, what is already evident is that once businesses have...

Microsoft shares new threat intelligence, security guidance during global crisis

Ready or not, much of the world was thrust into working from home, which means more people and devices are now accessing sensitive corporate data across home networks. Defenders are working round the clock to secure endpoints and ensure the fidelity of not only those endpoints, but also identitie...

Zero-Day Exploitation Increasingly Demonstrates Access to Money, Rather than Skill — Intelligence for Vulnerability Management, Part One

One of the critical strategic and tactical roles that cyber threat intelligence CTI plays is in the tracking, analysis, and prioritization of software vulnerabilities that could potentially put an organization’s data, employees and customers at risk. In this four-part blog series, FireEye Mandian...

Seeing Book Shelves on Virtual Calls

I have a confession... for me, the best part of virtual calls, or seeing any reporter or commentator working for home, is being able to check out their book shelves. I never use computer video, because I want to preserve the world's bandwidth. That means I don't share what my book shelves look li...

Microsoft works with healthcare organizations to protect from popular ransomware during COVID-19 crisis: Here’s what to do

True to form, human-operated ransomware campaigns are always on prowl for any path of least resistance to gain initial access to target organizations. During this time of crisis, as organizations have moved to a remote workforce, ransomware operators have found a practical target: network devices...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to WAS vulnerabilty (CVE-2019-4441).

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to security vulnerability. The vulnerability concerns IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty: a remote attacker could obtain sensitive information when a stack trace...

Tokyo Olympics Postponed, But 5G Security Lessons Shine

The 2020 Summer Olympics in Tokyo were officially postponed this week amid the ongoing, pandemic spread of the coronavirus that causes COVID-19. The Games will be moved to 2021, but in the meantime, technological innovation around the event will continue. More specifically, postponed or not, the...

WHO Targeted in Espionage Attempt, COVID-19 Cyberattacks Spike

The World Health Organization WHO has attracted the notice of cybercriminals as the worldwide COVID-19 pandemic continues to play out, with a doubling of attacks recently, according to officials there. Problematically, evidence has also now apparently surfaced that the DarkHotel APT group has tri...

Akamai Enhances Enterprise Threat Protector to Add Secure Web Gateway Capabilities

Today, Akamai announced that it has added secure web gateway SWG capabilities to its Enterprise Threat Protector ETP service to help enterprises further accelerate their transformation to a Zero Trust security architecture. So what are the SWG enhancements and what benefits will these deliver for...

March 2020 -- Akamai Edge Security: Leader in Five Forrester Wave Reports

Forrester has named Akamai a Leader in five different Wave and New Wave reports. This significant achievement reflects the strength of Akamai's intelligent edge platform for securing and delivering digital experiences across our entire security portfolio. Forrester Wave Leaders are the top vendor...

Monitoring ICS Cyber Operation Tools and Software Exploit Modules To Anticipate Future Threats

There has only been a small number of broadly documented cyber attacks targeting operational technologies OT / industrial control systems ICS over the last decade. While fewer attacks is clearly a good thing, the lack of an adequate sample size to determine risk thresholds can make it difficult f...