GDPR Is Here:  Assess the Security Configurations of Your IT Systems

In prior installments of this GDPR compliance blog series, we’ve discussed the importance of key security practices such as IT asset inventory and vulnerability management. Today, we’ll focus on another core component for GDPR: policy compliance. As we’ve stated before, to comply with the EU’s...

CVE-2017-14706

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/denyallwafexec.rb 2022-07-04 11:31:41+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/311 2025-02-06...

GDPR Is Here: Manage Vulnerabilities and Prioritize Threat Remediation

To provide the level of data protection required by the EU’s General Data Protection Regulation GDPR, your organization must continuously detect vulnerabilities, and prioritize their remediation. Why? An InfoSec team that’s chronically overwhelmed by its IT environment’s vulnerabilities and unabl...

DevSecOps: Practical Steps to Seamlessly Integrate Security into DevOps

To properly and effectively protect DevOps pipelines, organizations can’t blindly apply conventional security processes they’ve used for traditional network perimeters. Since DevOps’ value is the speed and frequency with which code is created, updated and deployed, security must be re-thought so...

Securing the Hybrid Cloud: A Guide to Using Security Controls, Tools and Automation

When a bank recently created a consumer mobile wallet, it built the entire project -- from development to deployment -- in the cloud, an increasingly common decision among enterprises. A less common step taken by this multinational bank and Qualys customer was incorporating the security team from...

Outpost24 OUTSCAN for detecting vulnerabilities on your network perimeter

Today I would like to write a post about Outpost24. This company was founded in 2001. For comparison, Tenable was founded in 2002 and Qualys in 1999. So, it's a company with a pretty long history. Outpost24 make Vulnerability Management & Web Application Security products and provide various...

WSSAT v2.0 - Web Service Security Assessment Tool

WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it performs both static and dynamic tests again...

CISO Forum and the problems of Vulnerability Databases

Last Tuesday, April 24, I was at "CISO FORUM 2020: glance to the future". I presented there my report "Vulnerability Databases: sifting thousands tons of verbal ore". In this post, I'll briefly talk about this report and about the event itself. My speech was the last in the program. At the same...

When Preparing for GDPR, Don’t Neglect Public Cloud Security

With organizations aggressively moving workloads to public cloud platforms, such as Amazon’s AWS, Google Cloud, and Microsoft’s Azure, protecting these environments is critical for compliance with the EU's General Data Protection Regulation GDPR. These public cloud platforms are being used to pow...

Orangeworm Targeting Healthcare Industry since 2015 Now Exposed

Operating since 2015, a threat group dubbed Orangeworm has been newly attributed to hacking and infiltrating healthcare groups around the world. Companies specifically targeted include hospitals, healthcare providers, pharmaceuticals, IT services firms serving the healthcare industry, and more...

CyberCentral Summit 2018 in Prague

Almost whole last week I spent in Prague at CyberCentral conference. It was a pretty unique experience for me. I was for the first time at the International conference as a speaker. And not only I presented my report there, but lead the round table on Vulnerability Management and participated in ...

The Sky Is Falling! Responding Rationally to Headline Vulnerabilities

It’s happening more and more. Gill Langston, a Qualys Director of Product Management, speaks at RSA Conference 2018 High profile vulnerabilities like Meltdown and Spectre are disclosed, and become headline-grabbing news not just in the technology press, but on general news outlets worldwide. Even...

Do not scan operational technology devices

The remote host appears to be operational technology device. Such devices often react very poorly when scanned. To avoid problems, Nessus will not continue to scan this device unless the scan policy is configured to scan OT devices. If you would like to safely assess security vulnerabilities on...

IkiWiki Detection Consolidation

Consolidation of IkiWiki detections. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Web Service Security Assessment Tool: WSSAT

WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it performs both static and dynamic tests again...

erfgoednlrcollecties.nl XSS vulnerability

Open Bug Bounty ID: OBB-599178 Description| Value ---|--- Affected Website:| erfgoednlrcollecties.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Arbitrary User Password Reset Vulnerability in Tianrongxin Vulnerability Scanning and Management System v3.3.0

TopScanner is a vulnerability scanning and management evaluation product that includes application detection, vulnerability scanning, vulnerability identification, risk analysis, and comprehensive assessment based on years of experience in network security product research and development by...

Override Access Vulnerability in Skyrunner Vulnerability Scanning and Management System v3.3.0

TopScanner, abbreviated as TopScanner, is a vulnerability scanning and management assessment product launched by Beijing Tianrongxin based on years of experience in network security product development, including application detection, vulnerability scanning, vulnerability identification, risk...

A “Patch for the Meltdown Patch” released out of band Thursday night

The Meltdown/Spectre saga continues… Late Thursday, Microsoft released a patch for Windows 7 and Server 2008 R2 operating systems to resolve CVE-2018-1038. Apparently, this vulnerability was actually introduced by the patches released in January to mitigate the effects of Meltdown. Microsoft did...

Securing your Cloud and Container DevOps Pipeline

Organizations are aggressively moving workloads to public cloud platforms, such as Amazon’s AWS, Google Cloud, and Microsoft’s Azure, upping the ante for InfoSec teams, which must protect these new environments. Driving this growth in cloud computing adoption is its essential role in digital...