Lock and Code S1Ep9: Strengthening and forgetting passwords with Matt Davey and Kyle Swank

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Matt Davey, chief operations optimist at 1Password, and Kyle Swank, a member of 1Password’s security team, about—what else—passwords. We may know it’s...

Five Password Tips for Securing the New WFH Normal

The shift to working from home is pushing system administrators to adjust to a new security normal. This includes new, high-profile challenges, such as the adoption of cloud applications, remote access to digital assets, and remote client support, to name a few. That said, good old-fashioned...

June 9, 2020—KB4561605 (OS Build 15063.2409)

None None...

Cloud data protection: how to secure what you store in the cloud

The cloud has become the standard for data storage. Just a few years ago, individuals and businesses pondered whether or not they should move to the cloud. This is now a question of the past. Today, the question isn't whether to adopt cloud storage but rather how. Despite its rapid pace of...

Eight Common OT / Industrial Firewall Mistakes

Most industrial sites deploy firewalls as the first line of defense for their Operations Technology OT / industrial networks. However, configuring and managing these firewalls is a complex undertaking. Configuration and other mistakes are easy to make. This article explores eight common mistakes...

openSUSE Security Update : vlc (openSUSE-2020-545)

This update for vlc fixes the following issues : vlc was updated to version 3.0.9.2 : + Misc: Properly bump the version in configure.ac. Changes from version 3.0.9.1 : + Misc: Fix VLSub returning 401 for earch request. Changes from version 3.0.9 : + Core: Work around busy looping when playing an...

CVE-2020-11796

In JetBrains Space through 2020-04-22, the password authentication implementation was insecure...

The passwordless present: Will biometrics replace passwords forever?

When it comes to securing your sensitive, personally identifiable information against criminals who can engineer countless ways to snatch it from under your nose, experts have long recommended the use of strong, complex passwords. Using long passphrases with combinations of numbers, letters, and...

Denial Of Service (DoS)

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

CVE-2020-5723

CVE-2020-5723 affects Grandstream UCM62xx/UCM6200 series (firmware 1.0.20.22 and earlier). Root cause: unencrypted user passwords stored in an SQLite database, enabling an attacker to retrieve passwords and potentially gain elevated privileges. Connected documents also reference related CVE-2020-...

OPENSUSE-SU-2020:0400-1 Security update for cloud-init

This update for cloud-init fixes the following security issues: - CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG bsc1162937. - CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936. This update was imported from the...

Tips for Securing Remote Workers

As more and more employees are mandated to work from home, security and non-security professionals alike are left wondering what they can do to keep their data and systems safe. To help with this, we’ve compiled a list of some of the key things you can do to ensure your defenses are up—on or off...

CVE-2020-6794

CVE-2020-6794 (Thunderbird) : The vulnerability occurs when a user who saved passwords before Thunderbird 60 later sets a master password; an unencrypted copy of those passwords remains accessible because the legacy password file isn’t deleted during data migration to the new format introduced in...

Information Disclosure

ansible is vulnerable to information disclosure. The vulnerability exists as the svn command run by the subversion module does not allow a password to be passed securely, allowing the password to be read by a manged node at /proc//cmdline...

CVE-2020-3841

CVE-2020-3841 affects Safari Login AutoFill. The issue, tied to UI handling, allowed a local user to send a password unencrypted over the network. Apple fixed this with Safari 13.0.5 and iOS/iPadOS 13.3.1 (and related security content), addressing the vulnerability by improved input/UI handling. ...

CVE-2012-5623

CVE-2012-5623 concerns Squirrelmail 4.0 using the outdated MD5 hashing algorithm for passwords. According to the connected records, the issue arises from the use of MD5 for password hashing, which can lead to weakened password security. The NVD entry lists CVSSv3.1 metrics with a base score of 7....

Hashcracker - Python Hash Cracker

Supportedhashing algorithms: SHA512, SHA256, SHA384, SHA1, MD5 Features: auto detection of hashing algorithm based on length not recommended, bruteforce, password list Arguments: type: hash algorithm must be one of the supported hashing algorithms mentioned above or AUTO if you want to use...

CVE-2020-2130

Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system...

CVE-2020-2133

CVE-2020-2133 affects Jenkins Applatix Plugin (1.1 and earlier). The vulnerability arises from storing a password unencrypted in job config.xml on the Jenkins master, allowing access by users with Extended Read permission or anyone with access to the master filesystem. This can expose credentials...

CVE-2020-2132

CVE-2020-2132 affects Jenkins Parasoft Environment Manager Plugin 2.14 and earlier. The vulnerability stems from passwords stored unencrypted in job config.xml on the Jenkins master, allowing access by users with Extended Read permission or those with master-file access. Impact described in sourc...