882 matches found
CVE-2025-60892
The CVE-2025-60892 issue affects Raspberry Pi Imager for Windows (1.9.6) where the OS customization feature’s public-key authentication setting unintentionally re-adds a local id_rsa.pub to the Pi’s authorized_keys file, even after users delete it in the UI. This creates an unintended attack surf...
CVE-2025-34135
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by...
CISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange Servers
The U.S. Cybersecurity and Infrastructure Security Agency CISA and National Security Agency NSA, along with international partners from Australia and Canada, have released guidance to harden on-premise Microsoft Exchange Server instances from potential exploitation. "By restricting administrative...
CVE-2025-34135
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by...
CVE-2025-34135 Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files
Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by...
CVE-2025-34135
Nagios XI prior to 2024R1.4.2 is affected by overly permissive permissions on systemd unit files, notably nagios.service having executable permissions not required. This could broaden local attack surface. Affected versions should be updated to 2024R1.4.2 or later; monitoring advisories also note...
Nagios XI 安全漏洞
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.4.2, which stems from overly lax...
Attack Surface Exposures: A Practical Guide
Many security teams believe their existing tools have them fully covered. With a firewall, endpoint protection, and a vulnerability scanner, it’s easy to assume you can see everything that matters. This is one of the most dangerous myths in cybersecurity today. These tools often operate in silos,...
A Practical Guide to Attack Surface Intelligence Mapping
Think of your organization’s digital presence as a sprawling, ever-expanding city. New buildings servers go up, old ones are forgotten, and unofficial shortcuts shadow IT appear overnight. Trying to defend this city without a current map is impossible. You’re left reacting to alarms instead of...
Cloud Attack Surface Management Mapping 101
Before an attacker launches an assault, they do their homework. Their first step is to meticulously map your digital footprint, searching for the path of least resistance—an exposed database, an unpatched server, or a forgotten subdomain. The reality is that your attack surface is already being...
Mapping Attack Surface for Enterprises: A 5-Step Guide
An attacker doesn’t see your company the way you do. They don’t see departments, projects, or business units. They see a collection of potential entry points—a web of digital assets they can probe for a single weakness. Their goal is to find the one unlocked door you forgot about. This is why...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987544)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987544 advisory. In the Linux kernel, the following vulnerability has been resolved: mm: khugepaged: skip huge page collapse for special files The read-only THP for filesystems will...
What Is a Platform for Continuous Exposure Assessment?
You can’t protect what you don’t know you have. In an environment of sprawling cloud instances, remote endpoints, and shadow IT, gaining a complete and accurate picture of your attack surface is a massive challenge. Periodic scans only provide a snapshot in time, missing assets that spin up and...
HCL BigFix Mobile 安全漏洞
HCL BigFix Mobile is a Mobile Device Management MDM solution offered by HCL India. It is designed to help businesses and organizations effectively manage and secure mobile devices, including smartphones, tablets and other mobile devices. A security vulnerability exists in HCL BigFix Mobile 3.3 an...
K000156624: BIG-IP Advanced WAF and ASM bd process vulnerability CVE-2025-61938
Security Advisory Description When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly...
Criminal IP to Showcase ASM and CTI Innovations at GovWare 2025 in Singapore
Torrance, United States, 14th October 2025, CyberNewsWire...
Beyond CVSS: Critical CVE Vulnerabilities Analysis
Attackers don't care about your CVSS scores. They care about finding a path into your network. That path might not be a single, glaring "critical" vulnerability. Often, it’s a chain of lower-severity weaknesses on overlooked assets that, when combined, give them the keys to the kingdom. This is w...
Countermind: A Multi-Layered Security Architecture for Large Language Models
The security of Large Language Model LLM applications is fundamentally challenged by "form-first" attacks like prompt injection and jailbreaking, where malicious instructions are embedded within user inputs. Conventional defenses, which rely on post hoc output filtering, are often brittle and fai...
The Difference Between Vulnerability and Exposure Management Explained
To build a truly effective defense, you have to learn to see your organization through an attacker's eyes. Attackers don't care about your internal vulnerability scan reports or how many patches you applied last week. They look for one thing: an open door. They search for an accessible pathway th...
