8613 matches found
CVE-2021-41995 PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks
A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass...
Microsoft at RSA 2022: Envisioning the future of security
Like most of you, I was glad to see the 2022 RSA Conference return to its in-person roots after a two-year digital hiatus. This year’s event was a great success, drawing 26,000 attendees to three days of cutting-edge security sessions, tutorials, seminars, and special events at Moscone Center in...
Microsoft at RSA 2022: Envisioning the future of security
Like most of you, I was glad to see the 2022 RSA Conference return to its in-person roots after a two-year digital hiatus. This year’s event was a great success, drawing 26,000 attendees to three days of cutting-edge security sessions, tutorials, seminars, and special events at Moscone Center in...
The vulnerability of the CLS_PK_KeyGenMT() function in the Rambus SafeZone basic crypto module allows a hacker to calculate private RSA keys from a public key of a TLS certificate.
The vulnerability of the CLSPKKeyGenMT function in the Rambus SafeZone base crypto module is related to the use of insufficiently random values. Exploiting this vulnerability could allow an attacker, operating remotely, to calculate secret RSA keys from the public key of a TLS certificate...
Researchers Uncover Ways to Break the Encryption of 'MEGA' Cloud Storage Service
A new piece of research from academics at ETH Zurich has identified a number of critical security issues in the MEGA cloud storage service that could be leveraged to break the confidentiality and integrity of user data. In a paper titled "MEGA: Malleable Encryption Goes Awry," the researchers poi...
[VIDEO] An Inside Look at the RSA 2022 Experience From the Rapid7 Team
!\VIDEO\ An Inside Look at the RSA 2022 Experience From the Rapid7 Teamhttps://blog.rapid7.com/content/images/2022/06/RSAC-2022-experience.jpg The two years since the last RSA Conference have been pretty uneventful. Sure, COVID-19 sent us all to work from home for a little while, but it's not as...
ASyncRat surpasses Dridex, TrickBot and Emotet to become dominant email threat
Earlier this year Malwarebytes released its 2022 Threat Review, a review of the most important threats and cybersecurity trends of 2021, and what they could mean for 2022. Among other things it covers the years alarming rebound in malware detections, and a significant shift in the balance of emai...
Threat Source newsletter (June 9, 2022) — Get ready for Cisco Live
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Another week, another conference. We’re heading a few miles southeast from San Francisco to Las Vegas for Cisco Live. I hope everyone had a safe, healthy and enjoyable RSA, but the fun isn’t over just... This is only...
The cloud gray zone—secret agents installed by cloud service providers
Wiz Research builds upon previous “OMIGOD” findings with a presentation at RSA Conference 2022; details how cloud middleware use across cloud service providers can expose customers' virtual machines to new attack vectors...
CVE-2022-2274
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X8664 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a...
Ransomware Task Force priorities see progress in first year
This blog is part of our live coverage from RSA Conference 2022: US President Joseph R. Biden Jr., The White House, and law enforcement agencies across the world paid close attention last year when a group of more than 60 cybersecurity experts launched the Ransomware Task Force, heeding the group...
Prometheus ransomware’s flaws inspired researchers to try to build a near-universal decryption tool
This blog is part of our live coverage from RSA Conference 2022: Prometheus—a ransomware build based on Thanos that locked up victims’ computers in the summer of 2021—included a major “vulnerability” that led security researchers at IBM to try and build a one-size-fits-all ransomware decryptor th...
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...
Unrestricted file upload
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 is affected by an unrestricted file upload vulnerability leading to remote code execution. The Nessus plugin for EMC RSA Archer identifies affected ranges as 6.x prior to 6.9.3.4 (6.9 SP3 P4) and 6.10.x prior to 6.10.0.2 (6.10 P2). A remote, authenticated attacker cou...
CVE-2021-33615
RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...
Threat Source newsletter (June 2, 2022) — An RSA Conference primer
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Many of you readers may be gearing up for a West Coast swing over the next few weeks through San Francisco and Las Vegas for RSA and Cisco Live, respectively. And we’re right behind you! Talos... This is only the...
The vulnerability of the CMD_DEVICE_GET_RSA_KEY_REQUEST function in Anker Eufy Homebase surveillance systems allows a intruder to bypass authentication procedures or gain unauthorized access to the device.
The vulnerability of the CMDDEVICEGETRSAKEYREQUEST function in Anker Eufy Homebase surveillance systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures or gain unauthorized access to the devic...