Third-Party Tests Rate VMware Carbon Black Cloud as a Leader in Protection, Detection; Platform Delivers 379% ROI for Customers

The biggest endpoint protection question for organizations right now is whether or not to upgrade from legacy approaches to cloud-native platforms with built-in EDR. If you boil this decision down to three key factors stronger protection, clearer visibility, and faster resolution, the choice...

Cisco AMP for Endpoints Mac Connector Software File Scan Denial of Service Vulnerability

A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files, resulting in a restart of the AMP Connector and a denial of service DoS condition of the Cisco AMP for Endpoints service. The vulnerabili...

Cisco AMP for Endpoints Linux and Mac Connector Software Buffer Overflow Vulnerability

Cisco AMP for Endpoints Mac Connector Software and Cisco AMP for Endpoints Linux Connector Software are both products of Cisco, Inc.Cisco AMP for Endpoints Mac Cisco AMP for Endpoints Mac Connector Software is a suite of endpoint applications based on the macOS platform that integrates static and...

amp-net.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1154584 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

2019: Looking Back at Malware

In 2019, attacker behavior evolved, becoming more evasive. The most common behaviors seen across all attack data—mapped to the MITRE ATT&CK™ Framework—were: Software Packing for Defense Evasion, Hidden Windows for Defense Evasion, Standard Application Layer Protocol for Command and Control C2,...

CVE-2020-3181

A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection AMP in Cisco AsyncOS Software for Cisco Email Security Appliances ESAs could allow an unauthenticated remote attacker to exhaust resources on an affected device. The vulnerability is due to insufficient...

CVE-2020-3181

CVE-2020-3181 : Cisco AsyncOS for Cisco Email Security Appliances (ESA) contains an uncontrolled resource-exhaustion vulnerability in the malware detection/AMP path due to insufficient control over memory allocation. An unauthenticated remote attacker can send a crafted email to exhaust device re...

RSA 2020 – That’s a Wrap!

Last week VMware Carbon Black attended the RSA Conference 2020 in San Francisco! This year was bigger than ever before, as we shared our vision for intrinsic security — for a safer, more effective world. Get all the highlights and check out some of our favorite moments in the wrap up below. The...

Design/Logic Flaw

An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform. This is possible due to the ability to overwrite a file on disk which is subsequently deserialized by the Java application component...

CVE-2019-5326

CVE-2019-5326 affects Aruba Airwave VisualRF with code execution on the AMP platform due to the ability to overwrite a disk file that is later deserialized by a Java component. The vulnerability arises from improper deserialization of a file write, enabling an administrative user with write acces...

cotreeview.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8547 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting cotreeview.com website and its users. Following coordinate...

CSI: Evidence Indicators for Targeted Ransomware Attacks - Part II | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting

Fifthplay S.A.M.I 2019.2HP - Persistent Cross-Site Scripting Exploit Title: Fifthplay S.A.M.I 2019.2HP - Persistent Cross-Site Scripting Date: 2020-01-29 Exploit Author: LiquidWorm Vendor: Fifthplay NV Vendor Homepage: https://www.fifthplay.com Version: 2019.2HP Tested on: Linux CVE : - Fifthplay...

UPDATE: MITRE CALDERA 2.5.0

MITRE CALDERA 2.5.0 is now available since the last release - MITRE CALDERA 2.4.0, which was released in the month of December. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. What is MITRE CALDERA? CALDERA is an...

Hunting for LoLBins

By Vanja Svajcer. Introduction Attackers' trends tend to come and go. But one popular technique we're seeing at this time is the use of living-off-the-land binaries — or "LoLBins". LoLBins are used by different actors combined with fileless malware and legitimate cloud services to improve chances...

amp-solar.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1013999 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting amp-solar.com website an...

amp-net.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1008633 Security Researcher Leonidas Helped patch 4 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting amp-net.fr website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the ISO...

Simple AMP (Accelerated Mobile Pages) - Moderately critical - Access bypass - SA-CONTRIB-2019-071

This module allows display of a site's content in AMP format. The module doesn't sufficiently check access on unpublished or restricted content...

Why Should CISOs Care About XDR?

We have been collectively saying in our industry for the last 15-20 years that a layered approach to your security stack is a “best practice,” but as with all best practices, these are ideals rather than reality for so many charged with protecting their organizations. The vast majority of CISOs a...

The Need for an Updated Kill Chain

“Cyber Kill Chain” The “Cyber Kill Chain”—created in 2011 by Lockheed Martin—was designed to be a model that “identifies what…adversaries must complete in order to achieve their objective.” This framework has been widely used through the cybersecurity world and informs prevention-heavy strategy. ...