Opencast Trust Management Issues Vulnerabilities

Opencast is a free and open source video management solution that is scalable, customizable and low cost. A trust management issue vulnerability exists in Opencast versions prior to 7.6 and prior to 8.1. The vulnerability stems from the lack of an effective trust management mechanism in a network...

Changing the Monolith—Part 4: Quick tech wins for a cloud-first world

You may have heard that identity is the “new” perimeter. Indeed, with the proliferation of phishing attacks over the past few years, one of the best ways to secure data is to ensure that identity—the primary way we access data—can be trusted. How do we secure identity? Start by evaluating how use...

Why You Need Cloud-Based Security for Agile, Innovative and Lean IT

Digital transformation isn't just a buzzworthy trend or a finite phase for today's businesses. Rolling adaptation to an ever-changing environment and continuous digital evolution has become the new normal for enterprises -- the key to success in this agile, demanding, and hyper-connected age. To...

.NET Partial-Trust bypass via browser command-line injection in System.Windows.Forms.Help

A command-line injection vulnerability exists in the core .NET class System.Windows.Forms.Help::ShowHelp function allowing an attacker without “UnmanagedCode” permission to nevertheless directly control arguments passed to a “ShellExecute” invocation of the users’ default browser. This...

JetBrains IntelliJ IDEA Operating System Command Injection Vulnerability

JetBrains IntelliJ IDEA is a Czech company JetBrains set of integrated development environment for the Java language . An operating system command injection vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2019.3. The vulnerability stems from the lack of an effective trust...

CVE-2020-0665

An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...

Cross site scripting

Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users Teacher and above to inject JavaScript into the session of another user e.g., enrolled student or site administrator via the introeditortext parameter. NOTE: the discoverer and vendor disagree on whether Mood...

Adive Framework Cross-Site Request Forgery Vulnerability

Adive Framework is a PHP-based MySQL database management framework . A cross-site request forgery vulnerability exists in Adive Framework. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit this...

Oracle Linux 7 : ipa (ELSA-2020-0378)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0378 advisory. - Resolves: 1777303 - CVE-2019-10195 ipa: batch API logging user passwords to /var/log/httpd/errorlog - CVE-2019-10195: Don't log passwords embedded in...

CVE-2020-6174

TUF aka The Update Framework through 0.12.1 has Improper Verification of a Cryptographic Signature...

RSA Conference 2020—Empower your defenders with artificial intelligence and automation

The RSA Conference 2020 kicks off in less than three weeks, and the Microsoft Security team can’t wait. This is one of our most important annual events because it provides an invaluable opportunity for us to connect with customers, partners, and other security thought leaders. New ideas are...

A week in security (January 27 – February 2)

Last week on Malwarebytes Labs, we looked at the strengths and weaknesses of the Zero Trust model, gave you the low-down on spear phishing, and took a delve into the world of securing the managed service provider MSP. Other cybersecurity news UN compromised via Sharepoint hack: An extraordinary...

Changing the Monolith—Part 3: What’s your process?

In my 25-year journey, I have led security and privacy programs for corporations and provided professional advisory services for organizations of all types. Often, I encounter teams frantically running around in their own silos, trying to connect the dots and yet unsure if those are the right dot...

5 identity priorities for 2020

Today, Joy Chik, Corporate Vice President of Identity, shared five priorities central to security that organizations should prioritize in 2020 as they digitally transform. These priorities are based on many conversations with our customers, including: 1. Connect all applications and cloud resourc...

Explained: the strengths and weaknesses of the Zero Trust model

In a US court of law, the accused are deemed to be innocent until proven guilty. In a Zero Trust security model, the opposite is true. Everything and everyone must be considered suspect—questioned, investigated, and cross-checked—until we can be absolutely sure it is safe to be allowed. Zero Trus...

Embracing Data Privacy Day

January 28 is Data Privacy Day, commemorating the Council of Europe Treaty known as Convention 108, the first legally binding international treaty on data protection signed on January 28, 1981. This "holiday" was originally celebrated in Europe where it is known as Data Protection day. But in 200...

Administrators of a different forest are unable to log on to PVS Console

Error : "An unexpected MAPI error occurred" Details: Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index Administrators of same forest as that of PVS servers are able to log in to the console of PVS servers, however, administrators of a...

Zero Trust Access: Santa Claus Wasn't the Only One Working Christmas Eve

The days from Christmas Eve to New Year's Day are filled with celebrations. Many companies shut down and encourage their employees to take vacations. However, a sample of data comparing an average work week around the holiday, shows the idea of "downtime" isn't exactly accurate. In fact, many use...

Microsoft and Zscaler help organizations implement the Zero Trust model

While digital transformation is critical to business innovation, delivering security to cloud-first, mobile-first architectures requires rethinking traditional network security solutions. Some businesses have been successful in doing so, while others still remain at risk of very costly breaches...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2019-2557)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...