Release Notes for Veeam Backup & Replication 9.5 Update 3a

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge Release Notes for Veeam Backup Replication 9.5 Update 3a Cause Please confirm that you are running version 9.5.0.580, 9.5.0.711, 9.5.0.802, 9.5.0.823,...

Security Bulletin: Security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator (CVE-2015-7417)

Summary Cross site scripting vulnerability has been identified in WebSphere Application Server OAuth Service Provider that is shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise Edition. This issue was also addressed by IBM Business Process Manager and IBM Tivoli System Automati...

Security Bulletin: Cross-site request forgery in Liberty for Java for IBM Bluemix (CVE-2017-1194)

Summary There is a potential cross-site request forgery in WebSphere Application Server OAuth service provider. Vulnerability Details CVEID: CVE-2017-1194 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious a...

Securing Containers at Scale: Amazon EKS, Amazon ECS and Deep Security Smart Check

Containers present a new opportunity for teams. An opportunity to deploy faster, more consistently, and with a simplicity rarely seen. But in order to make that happen a lot of infrastructure needs to be setup ahead of time. A cluster of hosts for the container runtime, an orchestration layer,...

Unable to Connect Veeam Service Provider Console to Veeam Cloud Connect Server Using a Local Account

Challenge Attempting to connect a Veeam Cloud Connect server through the VSPC web UI using a local account fails with the following error message: Failed to connect to the server. Specified user is invalid or does not have enough permissions on the server. Copy Cause The remote connection was...

Computer connection status is "Rejected" in Veeam Service Provider Console

Challenge You may see the following status for the computer in Veeam Service Provider Console - "Discovery" - "Discovered Computers": Solution Under "Discovered Computers" press "Change settings…" and turn on "Accept new connections" If this KB article did not resolve your issue or you need furth...

Modern Bank Heists: Cybersecurity Threats Facing the Financial Sector

Despite investing heavily in security, financial institutions continue to experience cyber attacks at a rapid pace. Conducted primarily for the purpose of yielding illicit financial gain, cyber attacks against the financial services industry are increasing in sophistication and are often...

How To Deploy NetScaler as Both OAuth SP and IdP

Deploying the NetScaler, as both an OAuth Service Provider SP and IdP Identity Provider or OpenID Authenticator. This can be on the same NetScaler, or on two separate appliances...

Antivirus Exclusions for Veeam Service Provider Console

Purpose This article documents antivirus exclusions that may be created to reduce the impact that antivirus software has on the functionality of Veeam Service Provider Console. These antivirus exclusions may be applied to the Windows built-in antivirus or third-party antivirus software. Note:...

Partner Perspectives: How an IT Service Provider and Red Canary Stopped a Malware Outbreak

Editor's Note: This blog originally appeared on redcanary.com. In this post, a technical account manager recounts how Red Canary partnered with an IT service provider to help one of their customers stop a rapidly spreading network worm. This blog goes behind the scenes of the incident response...

Shibboleth Service Provider Installed

Binary data shibbolethspinstalled.nbin...

Debian DLA-1296-1 : xmltooling security update

Kelby Ludwig and Scott Cantor discovered that the Shibboleth service provider is vulnerable to impersonation attacks and information disclosure due to incorrect XML parsing. For additional details please refer to the upstream advisory at...

Authentication bypass via incorrect XML canonicalization and DOM traversal

ruby-saml prior to version 1.7.0 is vulnerable to an authentication bypass via incorrect XML canonicalization and DOM traversal. Specifically, there are inconsistencies in handling of comments within XML nodes, resulting in incorrect parsing of the inner text of XML nodes such that any inner text...

CVE-2018-0489: Improper Verification of Cryptographic Signature

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this...

How to Migrate Veeam Service Provider Console to a New Server

The article describes how to move Veeam Availability Console installation and its database to a new server...

shibboleth-sp -- vulnerable to forged user attribute data

Shibboleth consortium reports: Shibboleth SP software vulnerable to additional data forgery flaws The XML processing performed by the Service Provider software has been found to be vulnerable to new flaws similar in nature to the one addressed in an advisory last month. These bugs involve the use...

JSP Store Locator, 2.4, SQL Injection

JSP Store Locator by Joomla Service Provider, versions 2.4 and previous, SQL Injection Resolution: update to 2.5 update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-store-locator-2-5-security-release.html...

JSP Tickets, 1.1, SQL Injection

JSP Tickets from Joomla Service Provider, versions 1.1 and previous, SQL Injection Resolution: update to version 1.2.0 Update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-tickets-1-2-security-release.html...

CVE-2018-2371

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...

CVE-2018-2371: Improper Neutralization of Input During Web Page Generation

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...