SaltStack Salt Master Server Root Key Disclosure

This module exploits unauthenticated access to the prepauthinfo method in the SaltStack Salt master's ZeroMQ request server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to disclose the root key used to authenticate administrative commands to the master. VMware vRealize Operations...

Afternoon Cyber Tea: Building operational resilience in a digital world

Operational resiliency is a topic of rising importance in the security community. Unplanned events, much like the one we are facing today, are reminders of how organizations can be prepared to respond to a cyberattack. Ian Coldwater and I explored a variety of options in my episode of Afternoon...

openSUSE: Security Advisory for python-nltk (openSUSE-SU-2020:0436-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Read permissions not enforced for client provided filter expressions in Elide.

Impact It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model. The adversary can construct filter expressions for an inaccessible field to filter a collection. The presence or absence ...

Manage Origin Offload and Egress Fees for Live and On-Demand

Origin offload has received more attention in the past few years as more customers have moved their origins to the cloud. As such, the cost to access data has become an important issue. To support this move, Akamai has developed Cloud Wrapper to provide customers with a way to securely connect to...

Fedora Update for libyang FEDORA-2019-dfe0b42bc5

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Important: Red Hat Security Advisory: libyang security update

An update for libyang is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: libyang security update

The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written and providing API in C. The library is used e.g. in libnetconf2, Netopeer2, sysrepo and FRRouting projects. Security Fixes: libyang: stack-based buffer...

RHEL 8 : libyang (RHSA-2019:4360)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:4360 advisory. The libyang package provides a library for YANG data modeling language. libyang is a YANG data modelling language parser and toolkit written...

Fedora Update for libyang FEDORA-2019-9d83929ffa

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: libyang-1.0.101-1.fc30

Libyang is YANG data modeling language parser and toolkit written and providing API in C...

[SECURITY] Fedora 31 Update: libyang-1.0.101-1.fc31

Libyang is YANG data modeling language parser and toolkit written and providing API in C...

Failure Modes in Machine Learning

Interesting taxonomy of machine-learning failures pdf that encompasses both mistakes and attacks, or -- in their words -- intentional and unintentional failure modes. It's a good basis for threat modeling...

CVE-2019-2941

Vulnerability in the Hyperion Profitability and Cost Management product of Oracle Hyperion component: Modeling. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Profitability...

CVE-2019-2941

Vulnerability in the Hyperion Profitability and Cost Management product of Oracle Hyperion component: Modeling. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Profitability...

How to Model Risk in an Apex Predator Cyber-World

The threat-intelligence researchers at Alphabet’s Chronicle have borrowed the apex predator concept from ecology to describe today’s multi-organizational, multinational threat actors — the evolution of which could provoke an overhaul of risk analysis and management. However, it’s important to kee...

Using Threat Modeling in Cybersecurity to Hunt and Remediate

Modern-day cyberattacks keep growing in sophistication and sheer volume. This dynamic makes it virtually impossible to detect and block all attacks using the traditional methods of comparing incoming requests to known attack signatures. To effectively operate in this new aggressive cyberthreat...

Using Threat Modeling in Cybersecurity to Hunt and Remediate

Modern-day cyberattacks keep growing in sophistication and sheer volume. This dynamic makes it virtually impossible to detect and block all attacks using the traditional methods of comparing incoming requests to known attack signatures. To effectively operate in this new aggressive cyberthreat...

[SECURITY] Fedora 30 Update: rubygem-activemodel-5.2.3-2.fc30

A toolkit for building modeling frameworks like Active Record. Rich support for attributes, callbacks, validations, serialization, internationalization, and testing...

Carbon Black and Chronicle: Stronger Cybersecurity through Big Data and Analytics

This is another exciting day for cybersecurity professionals, for Carbon Black and for me personally. It’s also a very exciting way to kick of RSA 2019! Earlier today, we announced an exciting new integration with Chronicle Security to harness the power of big data and analytics. Our goal is to...