CVE-2021-29253

The Tableau integration in RSA Archer 6.4 P1 6.4.0.1 through 6.9 P2 6.9.0.2 is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks...

Design/Logic Flaw

The Tableau integration in RSA Archer 6.4 P1 6.4.0.1 through 6.9 P2 6.9.0.2 is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks...

Cross site scripting

RSA Archer before 6.9 SP1 P1 6.9.1.1 contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields could potentially exploit this vulnerability to execute code in a victim's browser...

CVE-2021-29253

CVE-2021-29253 affects the Tableau integration in RSA Archer versions 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2). The underlying issue is insecure credential storage, which could allow an attacker who has access to the Tableau workbook file to obtain credential information for use in further attac...

CVE-2021-29253

The Tableau integration in RSA Archer 6.4 P1 6.4.0.1 through 6.9 P2 6.9.0.2 is affected by an insecure credential storage vulnerability. An malicious attacker with access to the Tableau workbook file may obtain access to credential information to use it in further attacks...

CVE-2021-29252

RSA Archer before 6.9 SP1 P1 6.9.1.1 contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields could potentially exploit this vulnerability to execute code in a victim's browser...

CVE-2021-29252

CVE-2021-29252 affects RSA Archer before 6.9 SP1 P1 (6.9.1.1). A remote authenticated Archer user with access to modify link name fields can trigger a stored cross-site scripting vulnerability, potentially causing code execution in a victim’s browser. Public references confirm affected versions i...

RSA Archer 安全漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK. A security vulnerability exists in RSA Archer between versions 6.4 and 6.9 that stems from a malicious attack capable of accessing Tableau workbook files, which can be exploited by an attacker to gain access ...

Oracle Linux 8 : python-cryptography (ELSA-2021-1608)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-1608 advisory. - CVE-2020-36242: Fixed a bug where certain sequences of update calls when symmetrically encrypting very large payloads 2GB could result in an integer...

RSA Archer 跨站脚本漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. It is able to aggregate all of our enterprise assets, as well as some of the monitored information, and organize it into a unified platform,...

pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

apache-commons-collections jss 4.8.1-2 - Bug 1932803 - HSM + FIPS: CMCRequest with a shared secret resulting in error 4.8.1-1 - Rebase to upstream JSS v4.8.1 - Red Hat Bugilla 1908541 - jss broke SCEP - missing PasswordChallenge class - Red Hat Bugilla 1489256 - RFE jss should support RSA with OA...

The Full Story of the Stunning RSA Hack Can Finally Be Told

In 2011, Chinese spies stole the crown jewels of cybersecurity—stripping protections from firms and government agencies worldwide. Here’s how it happened...

golang: math/big: panic during recursive division of very large numbers

A flaw was found in the math/big package of Go's standard library that causes a denial of service. Applications written in Go that use math/big via cryptographic packages, including crypto/rsa and crypto/x509, are vulnerable and can potentially cause panic via a crafted certificate chain. The...

RHEL 8 : python-cryptography (RHSA-2021:1608)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1608 advisory. The python-cryptography packages contain a Python Cryptographic Authority's PyCA's cryptography library, which provides cryptographic...

Moderate: python-cryptography security, bug fix, and enhancement update

The python-cryptography packages contain a Python Cryptographic Authority's PyCA's cryptography library, which provides cryptographic primitives and recipes to Python developers. The following packages have been upgraded to a later upstream version: python-cryptography 3.2.1. BZ1873581, BZ1891947...

What a Year It’s Been: RSA 2021 Embraces ‘Resilience’

Clearly, the months since the world shut down in March of 2020 fomented a radical shift in how people work and live, and it’s brought a range of crises and challenges to bear across the spectrum of our lives. These profound changes and experiences were also felt in cybersecurity, bringing...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m keynoting the all-virtual RSA Conference 2021, May 17-20, 2021. I’m keynoting the 5th International Symposium on Cyber Security Cryptology and Machine Learning via Zoom, July 8-9, 2021. I’ll be speaking at an Informa event on...

Cisco Adaptive Security Appliance Software Bleichenbacher Attack (cisco-sa-asaftd-tls-bb-2g9uWkP)

According to its self-reported version, the TLS handler of Cisco Adaptive Security Appliance ASA Software for Cisco Firepower 1000 is affected by the Bleichenbacher attack vulnerability due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely...

Cisco Firepower Threat Defense 1000 Series Bleichenbacher Attack (cisco-sa-asaftd-tls-bb-2g9uWkP)

According to its self-reported version, the TLS handler of Cisco Firepower Threat Defense FTD Software for Cisco Firepower 1000 Series firewalls is affected by the Bleichenbacher attack vulnerability due to improper implementation of countermeasures against the Bleichenbacher attack for cipher...

Threat spotlight: DarkSide, the ransomware used in the Colonial Pipeline attack

Late last week, the business network systems of Colonial Pipeline, the biggest supplier of fuels on the East Coast of the United States, were compromised due to a ransomware attack, forcing the company to temporarily shut down its operations while investigations are underway. Monday morning,...