Ransomware Task Force priorities see progress in first year

This blog is part of our live coverage from RSA Conference 2022: US President Joseph R. Biden Jr., The White House, and law enforcement agencies across the world paid close attention last year when a group of more than 60 cybersecurity experts launched the Ransomware Task Force, heeding the group...

Prometheus ransomware’s flaws inspired researchers to try to build a near-universal decryption tool

This blog is part of our live coverage from RSA Conference 2022: Prometheus—a ransomware build based on Thanos that locked up victims’ computers in the summer of 2021—included a major “vulnerability” that led security researchers at IBM to try and build a one-size-fits-all ransomware decryptor th...

CVE-2021-33615

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...

CVE-2021-33615

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...

CVE-2021-33615

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...

Unrestricted file upload

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...

CVE-2021-33615

RSA Archer 6.8.00500.1003 P5 is affected by an unrestricted file upload vulnerability leading to remote code execution. The Nessus plugin for EMC RSA Archer identifies affected ranges as 6.x prior to 6.9.3.4 (6.9 SP3 P4) and 6.10.x prior to 6.10.0.2 (6.10 P2). A remote, authenticated attacker cou...

CVE-2021-33615

RSA Archer 6.8.00500.1003 P5 allows Unrestricted Upload of a File with a Dangerous Type...

Threat Source newsletter (June 2, 2022) — An RSA Conference primer

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Many of you readers may be gearing up for a West Coast swing over the next few weeks through San Francisco and Las Vegas for RSA and Cisco Live, respectively. And we’re right behind you! Talos... This is only the...

The vulnerability of the CMD_DEVICE_GET_RSA_KEY_REQUEST function in Anker Eufy Homebase surveillance systems allows a intruder to bypass authentication procedures or gain unauthorized access to the device.

The vulnerability of the CMDDEVICEGETRSAKEYREQUEST function in Anker Eufy Homebase surveillance systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to bypass authentication procedures or gain unauthorized access to the devic...

Security Bulletin: Vulnerability in IBM Java SDK Runtime affects DS8000 (CVE-2015-0138)

Summary The “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability affects some versions of DS8000. Vulnerability Details CVEID: CVE-2015-0138 DESCRIPTION: A vulnerability in SSL/TLS implementations could allow a remote attacker to downgrade the security of certain...

GHSA-H8V5-P258-PQF4 Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API

Impact XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. Note that this API is never used in XWiki Standard but it might be used in some extension...

Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API

Impact XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. Note that this API is never used in XWiki Standard but it might be used in some extension...

Connect with Wiz at our first-ever RSA Conference

We can’t wait to see many of you at RSA Conference 2022 in San Francisco, June 6-9. Check out a demo at our booth, attend a Wiz speaking session, or unwind at our SFMOMA party!...

new packages: perl-Crypt-OpenSSL-RSA

An update is available for perl-Crypt-OpenSSL-RSA. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

GHSA-WG33-X934-3GHH jwcrypto lacks the Random Filling protection mechanism

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

jwcrypto lacks the Random Filling protection mechanism

The Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack MMA...

GHSA-PM9M-W23Q-5967 Zend Framework Information Disclosure

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

Zend Framework Information Disclosure

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

Microsoft showcases the future of comprehensive security at RSA 2022

The last time the RSA Conference was held as an in-person event was in 2020. Needless to say, a lot has changed since then. RSA is once again going forward as an in-person and digital event in San Francisco, from June 6 to 9, 2022. After two years of remote interactions, we’re excited to exchange...