Webshell Bypass Vulnerability in D-Shield Firewall of Shenzhen Di Element Technology Co. Ltd (CNVD-2020-18728)

D-ShieldFirewall is an active defense protection software designed specifically for IIS to prevent websites and servers from being invaded by internal and external protection, and is designed based on the concept that the fewer the functions, the safer the server is under the normal operation of...

Webshell Bypass Vulnerability in D-Shield Firewall of Shenzhen Di Element Technology Co. Ltd (CNVD-2020-18726)

D-ShieldFirewall is an active defense protection software designed specifically for IIS to prevent websites and servers from being invaded by internal and external protection, and is designed based on the concept that the fewer the functions, the safer the server is under the normal operation of...

Default credentials

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...

CVE-2020-9330

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices e.g., by using default credentials can change the LDAP connection IP...

CVE-2020-3114

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based...

Cynet Offers Free Threat Assessment for Mid-sized and Large Organizations

Visibility into an environment attack surface is the fundamental cornerstone to sound security decision making. However, the standard process of 3rd party threat assessment as practiced today is both time consuming and expensive. Cynet changes the rules of the game with a free threat assessment...

Critical Bug in WordPress Theme Plugin Opens 200,000 Sites to Hackers

A popular WordPress theme plugin with over 200,000 active installations contains a severe but easy-to-exploit software vulnerability that, if left unpatched, could let unauthenticated remote attackers compromise a wide range of websites and blogs. The vulnerable plugin in question is 'ThemeGrill...

Cisco Software Maintenance Update Enumeration

It is possible to enumerate the installed Cisco Software Maintenance Updates on the remote Cisco device using the 'show install active' or 'show version' command. TRUSTED...

Mattress Firm deployed Azure Active Directory to securely connect Firstline Workers to their SaaS apps and to each other

Today, we have another interesting story for the Voice of the Customer blog series. Tony Miller and Jon Sider of Mattress Firm deployed Azure Active Directory Azure AD to create a secure authentication experience for employees, including their Firstline Workforce. Much like sleep and a good...

Microsoft Windows Multiple Vulnerabilities (KB4537789)

This host is missing a critical security update according to Microsoft KB4537789 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

LDAP Windows Update (ADV190023) and Impact to Citrix Virtual Apps and Desktop Components

Impact to Citrix Technology This update will not impact Citrix Virtual App and Desktop Windows components: The update anticipated for the second half of 2020 requires SSL/TLS encryption for communication occurring over 389 and 636 to prevent any PLAINTEXT communication over both ports. Virtual Ap...

Microsoft Windows Multiple Vulnerabilities (KB4537764)

This host is missing a critical security update according to Microsoft KB4537764 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4537776)

This host is missing a critical security update according to Microsoft KB4537776 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-0665

An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...

CVE-2020-0665

An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...

Privilege escalation

An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...

Microsoft Addresses Active Attacks, Air-Gap Danger with 99 Patches

Microsoft has issued one of its largest Patch Tuesday updates for the shortest month of the year, addressing 99 security vulnerabilities across a range of products. Twelve of the bugs are listed as critical – and the rest are rated as being important. The update includes a patch for the zero-day...

CVE-2020-0665

An elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'...

CVE-2020-0665

CVE-2020-0665 is an Active Directory elevation-of-privilege issue in forest trusts caused by a default setting that allows a trusting-forest attacker to request delegation of a TGT for an identity from the trusted forest. The description notes the impact and context, but no explicit remediation i...

Active Directory Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way Active Directory handles information for domains in a transitively trusted forest. To exploit this vulnerability, an attacker would first need to compromise a transitively trusted Active Directory forest. An attacker who successfully...