WordPress Plugin Bug Lets Subscribers Wipe Sites

Researchers have discovered a homicidal WordPress plugin that allows subscribers to wipe sites clean of content. The high-severity security flaw is found in Hashthemes Demo Importer, a plugin that’s used in more than 8,000 active installations. According to security researchers at Wordfence, the...

Defending Assets You Don’t Know About Against Cyberattacks

Back in the 90s, we all used to build massive firewalls around our systems and spent our day-to-day resources looking for holes to patch. In theory, an impenetrable wall around everything you own is a great idea, because it protects even the things you’ve forgotten about. However, if a wall is yo...

Microsoft Surface Hub Security Feature Issue Vulnerability

The Microsoft Surface Hub is a tablet computer from Microsoft Corporation USA. A security signature issue vulnerability exists in the Microsoft Surface Pro 3, no details of the vulnerability are available at this time...

DEBIAN-CVE-2021-41160

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send 0...

UBUNTU-CVE-2021-41160

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send 0...

CVE-2021-42299

Microsoft Surface Pro 3 Security Feature Bypass Vulnerability...

CVE-2021-42299

Microsoft Surface Pro 3 Security Feature Bypass Vulnerability...

Security feature bypass

Microsoft Surface Pro 3 Security Feature Bypass Vulnerability...

CVE-2021-42299

CVE-2021-42299 affects Microsoft Surface Pro 3 and is described as a security feature bypass vulnerability. From the provided data, the vulnerability is local in scope (attack vector LOCAL, no user interaction required per CVSS), with partial confidentiality and integrity impact and no availabili...

CVE-2021-42299 Microsoft Surface Pro 3 Security Feature Bypass Vulnerability

...

Microsoft Warns of New Security Flaw Affecting Surface Pro 3 Devices

Microsoft has published a new advisory warning of a security bypass vulnerability affecting Surface Pro 3 convertible laptops that could be exploited by an adversary to introduce malicious devices within enterprise networks and defeat the device attestation mechanism. Tracked as CVE-2021-42299 CV...

CVE-2021-42299: Undefined Security Weakness

Microsoft Surface Pro 3 Security Feature Bypass Vulnerability...

Microsoft Surface Pro 3 Security Feature Bypass Vulnerability

...

PT-2021-7047

Name of the Vulnerable Software and Affected Versions Microsoft Surface Pro 3 affected versions not specified Description The vulnerability is related to errors in authorization, allowing an attacker to bypass existing security restrictions. It is associated with the TPM Carte Blanche attack, whi...

KLA12326 SB vulnerability in Microsoft Device

A security feature bypass vulnerability was found in Microsoft Device. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2021-42299 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Surface CVE list...

From Technical Features to Customer Security Metrics

Qualys solutions are packed with great functionality to deliver operational efficiency to all our customers, but the value does not end with bits and bytes. Qualys customers can count on Technical Account Managers to maximize the effectiveness of their subscription, and this post tells a story...

Attacking a Macro Security Problem with Micro-segmentation

Ransomware is everywhere. And the shift of workloads to the cloud and employees to work-from-home models has only expanded the attack surface, creating new opportunities for attackers to leverage. Companies need Zero Trust solutions that not only defend against threat actors gaining access to...

High-Severity RCE Flaw Disclosed in Several Netgear Router Models

Networking equipment company Netgear has released patches to remediate a high-severity remote code execution vulnerability affecting multiple routers that could be exploited by remote attackers to take control of an affected system. Traced as CVE-2021-40847 CVSS score: 8.1, the security weakness...

Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability

In August, Microsoft Threat Intelligence Center MSTIC identified a small number of attacks less than 10 that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as...

A4: XML External Entities (XXE) ❗️ — Top 10 OWASP 2017

A4: XML External Entities XXE ❗️ — Top 10 OWASP 2017 Introduction XML presents a useful resource for sending data from service to service and for data processing internally but with anything, as soon as user input gets involved, things get dangerous. The processing of these files comes with an...