Design/Logic Flaw

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...

CVE-2019-9628

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...

CVE-2019-9628

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...

CVE-2019-9628

The CVE-2019-9628 entry concerns the XMLTooling library (versions prior to V3.0.4) bundled with OpenSAML and Shibboleth SP. A parsing issue in the XML declaration causes an exception type that is not properly handled, propagating an unexpected exception. OpenSUSE/SUSE advisories explicitly link C...

CVE-2019-9628

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...

CVE-2019-7383

An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/ispupdateedit.php does not properly validate user input, which leads to...

Email service provider loses 2 decades worth of data due to hack attack

By Waqas Famed secure email service provider VFEmail has become a victim of a hack attack by an unknown cybercriminal. The company claims that it has suffered a “catastrophic destruction” of its US servers and almost two decades of data and backups in only a few hours. The entire digital...

Super-systemic IoT flaws

IoT security flaws were always systemic: by that I mean that if I find a flaw in my smart thermostat, it affects ALL of those thermostats. A security problem with one connected car leads to problems with ALL the connected cars using that same system. That led to incidents such as the Mirai botnet...

Cloud Connect replication fails with "The following hosts are incompatible with the target host"

Challenge An attempt to start or create a Cloud Connect replication job fails with the error message: " The following hosts are incompatible with the target host". Cause The following scenarios are known to cause the issue: 1. Tenant's Veeam installation had been updated to the latest version 9.5...

SAML Signature Wrapping

samlify is vulnerable to signature wrapping. An attacker is able wrap the signature of a SAML response and insert a new username in the original SAML token received from IdP before validating with the service provider. This allow the attacker to forge a token and impersonate as another user...

Accelerating PCI Data Security Standard projects with Deep Security as a Service

Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...

Veeam Service Provider Console – Compile and Upload Management Agent Logs

Challenge This article covers how to Management Agent logs for both client agents and the Cloud Connect agent. Solution Export Management Agent Logs To export Veeam Service Provider Console Management Agent logs for one or more client agents, please: 1. Log into the Veeam Service Provider Console...

Veeam Service Provider Console – Compile and Upload Server Logs

Purpose This article provides information about collecting Veeam Service Provider Console logs. Solution The log collection procedure for Veeam Service Provider Console is documented in the User Guide: Downloading Veeam Service Provider Console Logs Tip: Use the Archive button in the top-right of...

Veeam Service Provider Console – Compile and Upload ConnectWise Manage Plugin Logs

This article covers how to properly compile your Veeam Service Provider Console ConnectWise Manage Plugin logs...

Release Notes for Veeam Backup & Replication 9.5 Update 3a

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge Release Notes for Veeam Backup Replication 9.5 Update 3a Cause Please confirm that you are running version 9.5.0.580, 9.5.0.711, 9.5.0.802, 9.5.0.823,...

Security Bulletin: Security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator (CVE-2015-7417)

Summary Cross site scripting vulnerability has been identified in WebSphere Application Server OAuth Service Provider that is shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise Edition. This issue was also addressed by IBM Business Process Manager and IBM Tivoli System Automati...

Security Bulletin: Cross-site request forgery in Liberty for Java for IBM Bluemix (CVE-2017-1194)

Summary There is a potential cross-site request forgery in WebSphere Application Server OAuth service provider. Vulnerability Details CVEID: CVE-2017-1194 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site request forgery which could allow an attacker to execute malicious a...

Securing Containers at Scale: Amazon EKS, Amazon ECS and Deep Security Smart Check

Containers present a new opportunity for teams. An opportunity to deploy faster, more consistently, and with a simplicity rarely seen. But in order to make that happen a lot of infrastructure needs to be setup ahead of time. A cluster of hosts for the container runtime, an orchestration layer,...

Computer connection status is "Rejected" in Veeam Service Provider Console

Challenge You may see the following status for the computer in Veeam Service Provider Console - "Discovery" - "Discovered Computers": Solution Under "Discovered Computers" press "Change settings…" and turn on "Accept new connections" If this KB article did not resolve your issue or you need furth...

Unable to Connect Veeam Service Provider Console to Veeam Cloud Connect Server Using a Local Account

Challenge Attempting to connect a Veeam Cloud Connect server through the VSPC web UI using a local account fails with the following error message: Failed to connect to the server. Specified user is invalid or does not have enough permissions on the server. Copy Cause The remote connection was...