Information disclosure

Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure...

CVE-2019-0380

CVE-2019-0380 affects SAP Landscape Management enterprise edition prior to 3.0. The vulnerability arises when default values of custom secure parameters are included in application logs, causing information disclosure. The description and multiple sources corroborate a log-based exposure in SAP L...

CVE-2019-0380

Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure...

SAP Landscape Management CVE-2019-0380 Information Disclosure Vulnerability

Description SAP Landscape Management is prone to an unspecified information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. SAP Landscape Management 3.0 is vulnerable; other versions may also be affected...

telluride-landscape-photography.com Open Redirect vulnerability

Security Researcher devl00p Helped patch 2581 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting telluride-landscape-photography.com website and its user...

CB Customer Spotlight: Q&A with MEDNAX’s Don Cox

With over 30 years of experience in the technology landscape, Don Cox knows what it takes to be a leader in the industry. Currently residing as the CISO at MEDNAX, the physician-led healthcare organization headquartered in Sunrise, FL, Cox is responsible for cyber operations and engineering,...

Trend Micro Named A Leader in 2019 Gartner Magic Quadrant for Endpoint Protection Platforms

Leadership. It’s a weighty term, although frequently it is used too lightly and all too often it’s a self-declared position. We believe, leaders can come and go, and leadership can be fleeting depending on the factors for long term success. It is for all these reasons, that we are proud, not only...

Innovate or Die?

The recent series of IT acquisitions and IPOs highlight a simple economic fact: companies that fail to keep up with the fast-paced innovation of technology can easily become targets for acquisition. Mark Twain put it this way: History doesn’t repeat itself, but it rhymes. As a former Gartner...

MegaCortex Ransomware Revamps for Mass Distribution

A dangerous enterprise-focused ransomware, MegaCortex, has been retooled to become a weapon for wide-scale attacks. Previously used only in manual, post-network-exploitation, targeted campaigns on carefully selected targets, MegaCortex now has a second variant that adds automation to the kill...

The Future is Female: A Key to the Cybersecurity Workforce Challenge

By 2022, 2 million cybersecurity positions globally are projected to be open, even as the threat landscape accelerates and becomes more complex. To meet this growing workforce shortage, women are a crucial, largely untapped reservoir of talent that businesses should be courting. In this Threatpos...

Microsoft’s Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time

I'm excited to announce that Microsoft’s Threat & Vulnerability Management solution is generally available as of June 30! We have been working closely with customers for more than a year to incorporate their real needs and feedback to better address vulnerability management. Our goal is to empowe...

5 Keys to Improve Your Cybersecurity

Cybersecurity isn't easy. If there was a product or service you could buy that would just magically solve all of your cybersecurity problems, everyone would buy that thing, and we could all rest easy. However, that is not the way it works. Technology continues to evolve. Cyber attackers adapt and...

CVE-2019-0312

Several web pages provided SAP NetWeaver Process Integration versions: SAPXIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAPXITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50 are not password protected. An attacker could access landscape information like host names, ports or other technical data...

Troy Hunt: 'Messy' Password Problem Isn't Getting Better

LONDON, UK – The security world is facing a major issue that has led to widespread breaches, data exposure, and more – and it all stems from millions of insecure passwords used for everything from enterprise PCs to internet of things IoT devices. Poor password hygiene – including reusing password...

Integrating Threat and Vulnerability Management with Patch Management: The (Feasible) Quantum Leap

The rise of sophisticated attacks combined with the security-skills shortage have driven many organizations to go back to basics and review their processes for vulnerability and patch management. The approach is definitely a winning one, given that shrinking and managing the vulnerability surface...

Verizon’s DBIR Highlights Key Drivers of Security Risk

It’s that time of the year when Verizon updates us on the latest trends in the global threat landscape with its Data Breach Investigations Report DBIR. The findings in this year’s report are based on data provided by more than 70 sources including Qualys about more than 41,000 security incidents,...

Evolving Threat Hunting with the MITRE ATT&CK Framework at CB Connect

Evolving Threat Hunting with the MITRE ATT&CK Framework – Join me at CB Connect San Diego! There are a number of techniques you can use to uncover security gaps leveraging the MITRE ATT&CK matrix. At CB Connect San Diego, our annual user conference June 4-5th, I will speaking on “How to Evolve Yo...

SAP Gateway Remote Command Execution

Added: 05/07/2019 Background SAP Gateway is a development framework, which allows non-SAP applications to communicate with SAP applications. Problem SAP Gateway behavior depends on two parameters, aclmode and simmode. If SAP Gateway access control lists ACLs are configured aclmode=0, anonymous...

The vulnerability of the SAP HANA Extended Application Services application development tool in the SAP Landscape Management automation system allows a perpetrator to execute arbitrary code.

The vulnerability of the SAP HANA Extended Application Services application development tool in the SAP Landscape Management automation system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a special...

SAP Gateway Remote Command Execution

Added: 05/07/2019 Background SAP Gateway is a development framework, which allows non-SAP applications to communicate with SAP applications. Problem SAP Gateway behavior depends on two parameters, aclmode and simmode. If SAP Gateway access control lists ACLs are configured aclmode=0, anonymous...