MDR, MEDR, SOCaaS: Which Is Right for You?

Getting the most from managed services Even if a security team was given a blank check to spend whatever they wanted and hire however they wanted, it would still be a massive effort to build a detection and response D&R program tailored to that organization’s specific needs. Thankfully, the...

Tarrask malware uses scheduled tasks for defense evasion

As Microsoft continues to track the high-priority state-sponsored threat actor HAFNIUM, new activity has been uncovered that leverages unpatched zero-day vulnerabilities as initial vectors. The Microsoft Detection and Response Team DART in collaboration with the Microsoft Threat Intelligence Cent...

Unauthorized Access Vulnerability in Seven Bulls Logkit Monitoring Center

Shanghai Seven Bulls Information Technology Co., Ltd. is a cloud computing and data service provider. An unauthorized access vulnerability exists in Seven Bulls Logkit Monitoring Center, which can be exploited by attackers to obtain sensitive information...

GHSA-XHQQ-X44F-9FGG Authentication Bypass in github.com/russellhaering/gosaml2

Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...

Authentication Bypass in github.com/russellhaering/gosaml2

Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...

Authentication flaw

fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audience verification. This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reu...

CVE-2022-23600 Limited ability to spoof SAML authentication with missing audience verification

fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audience verification. This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reu...

Veeam Service Provider Console fails to connect to restored VSPC database due to collation conflict

Challenge When attempting to connect Veeam Service Provider Console to an existing VSPC database the following error occurs: Implicit conversion of varchar value to varchar cannot be performed because the collation of the value is unresolved due to a collation conflict between "" and "" in add...

Release Information for Veeam Service Provider Console v6 Patch 1

Requirements Please confirm you are running Veeam Service Provider Console version 6.0.0.7739 or later before installing Patch 1. You can check this by logging in to the backup portal and navigating to theConfiguration Support Information tab. After upgrading, your server build will be 6.0.0.8787...

CVE-2021-44757

Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server...

File Upload Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Ltd (CNVD-2022-10318)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. A file upload vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Co. Ltd, which can be exploited by an attacker to gain control of the server...

Arbitrary File Read Vulnerability in the Flash Flood Monitoring and Early Warning Platform of Siltronic Technology Limited (CNVD-2022-10308)

Siltronic Ltd. is an information service provider for disaster reduction and profitability in China. An arbitrary file read vulnerability exists in the flash flood monitoring and early warning platform of Sicron Technology Limited, which can be exploited by attackers to obtain sensitive informati...

Service Provider Console displays duplicate entries for machines when Veeam Agent is installed on Citrix VM.

Article Applicability This article documents an issue resolved in Veeam Service Provider Console 7. Challenge When VMs on Citrix Hypervisor formerly known as XenServer that is orchestrated by Cloudstack Apache or Azure Stack Hub and using Veeam Agent for Microsoft Windows or for Linux are managed...

Moobot Botnet Chews Up Hikvision Surveillance Systems

Although a patch was released in September, any still-vulnerable Hikvision IP Network Video Recorder NVR products are being actively targeted by the Mirai-based botnet known as Moobot. FortiGuard Labs has released a report detailing how the Moobot botnet is leveraging a known remote code executio...

How to investigate service provider trust chains in the cloud

In a recent Microsoft blog post, we documented technical guidance for organizations to protect themselves from the latest NOBELIUM activity that was found to target technology service providers, which are privileged in their downstream customer tenants, as a method to gain access to their...

SQL Injection Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd.

SCT is an information service provider in China, dedicated to the cause of disaster mitigation and benefit reduction, and provides the government with comprehensive solutions for disaster mitigation and benefit reduction informatization. A SQL injection vulnerability exists in the Flash Flood...

Micro Focus Access Manager Information Leakage Vulnerability

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used...

CVE-2021-35225

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

CVE-2021-35225

Each authenticated Orion Platform user in a MSP Managed Service Provider environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination...

Veeam Service Provider Console v5 Patch 4

More Recent Version Available Please find the latest version of Veeam Service Provider Console here: https://www.veeam.com/service-providers-download.html Requirements Please confirm you are running version 5.0.0.6726 or later before installing Patch 4. You can check this by logging in to the...