897 matches found
BEC-ware the Phish (part 2): Respond and Remediate Incidents in M365
TL;DR Ensure you can reliably take initial containment actions such as disabling accounts, resetting passwords, and revoking tokens. Token binding ensures that a token only works on the specific device the token was issued and is currently the best protection against token theft. As a minimum...
CVE-2024-9191
The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine...
5 SaaS Misconfigurations Leading to Major Fu*%@ Ups
With so many SaaS applications, a range of configuration options, API capabilities, endless integrations, and app-to-app connections, the SaaS risk possibilities are endless. Critical organizational assets and data are at risk from malicious actors, data breaches, and insider threats, which pose...
Fortinet Fortigate MFA bypass by changing username case (FG-IR-19-283)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-19-283 advisory. - An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user...
Why Phishing-Resistant MFA Is No Longer Optional: The Hidden Risks of Legacy MFA
Sometimes, it turns out that the answers we struggled so hard to find were sitting right in front of us for so long that we somehow overlooked them. When the Department of Homeland Security, through the Cybersecurity and Infrastructure Security Agency CISA, in coordination with the FBI, issues a...
Iranian Hackers Target Microsoft 365, Citrix Systems with MFA Push Bombing
Iranian hackers are targeting critical infrastructure organizations with brute force tactics. This article explores their techniques, including MFA…...
U.S. and Allies Warn of Iranian Cyberattacks on Critical Infrastructure in Year-Long Campaign
Cybersecurity and intelligence agencies from Australia, Canada, and the U.S. have warned about a year-long campaign undertaken by Iranian cyber actors to infiltrate critical infrastructure organizations via brute-force attacks. "Since October 2023, Iranian actors have used brute force and passwor...
Modernization of Authentication: Webinar on MFA, Passwords, and the Shift to Passwordless
The interest in passwordless authentication has increased due to the rise of hybrid work environments and widespread digitization. This has led to a greater need for reliable data security and user-friendly interfaces. Without these measures, organizations are at risk of experiencing data breache...
GO-2024-3160 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials in github.com/ory/kratos
Ory Kratos's setting requiredaal highestavailable does not properly respect code + mfa credentials in github.com/ory/kratos...
GHSA-WC43-73W7-X2F5 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials
Preconditions - The code login method is enabled with the passwordlessenabled flag set to true . - A 2FA method such as totp is enabled. - requiredaal of the whomai check or the settings flow is set to highestavailable. AAL stands for Authenticator Assurance Levels and can range from 0 no factor ...
Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials
Preconditions - The code login method is enabled with the passwordlessenabled flag set to true . - A 2FA method such as totp is enabled. - requiredaal of the whomai check or the settings flow is set to highestavailable. AAL stands for Authenticator Assurance Levels and can range from 0 no factor ...
CVE-2024-45042
Summary of CVE-2024-45042 (Ory Kratos) : Before version 1.3.0, under certain preconditions, the setting highest_available can misreport the identity’s highest AAL, reporting it as aal1 instead of the true aal2. This causes the system to behave as if the user has only one factor, allowing requests...
CVE-2024-45042 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials
Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the highestavailable setting will incorrectly assume that the identity’s highest available AAL is aal1 even though it really is aal2. This means that t...
HPESBMU04711 rev.1 - HPE IceWall Agent products, Cross-Site Request Forgery (CSRF)
Potential Security Impact: Remote: Cross-Site Request Forgery CSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall Federation Agent - Prior to 4.0 RHEL, Windows - SAML SP module IceWall Gen11 Enterprise Edition - Prior to 11.0 RHEL, Windows - Agent module IceWall Gen11...
Say Goodbye to Phishing: Must-Haves to Eliminate Credential Theft
Even as cyber threats become increasingly sophisticated, the number one attack vector for unauthorized access remains phished credentials Verizon DBIR, 2024. Solving this problem resolves over 80% of your corporate risk, and a solution is possible. However, most tools available on the market toda...
CVE-2024-32006
A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application does not expire the user session on reboot without logout. This could allow an attacker to bypass Multi-Factor Authentication...
CVE-2024-42345
CVE-2024-42345 affects SINEMA Remote Connect Server prior to v3.2 SP2. The vulnerability is a session-fixation flaw where improper handling of user session establishment/invalidation could allow a remote attacker to bypass the additional multi-factor authentication for user session establishment....
Multiple Vulnerabilities in Veeam Backup & Replication
On Wednesday, September 4, 2024, backup and recovery software provider Veeam released their September security bulletin disclosing various vulnerabilities in Veeam products. One of the higher-severity vulnerabilities included in the bulletin is CVE-2024-40711, a critical unauthenticated remote co...
