Seeing Is Securing: How Surface Command Expands MDR Visibility and Impact

Imagine hiring a professional security team to guard your home — only to discover they’re doing so by monitoring camera feeds from only the front of the house — securing the front door but blissfully unaware of the unlocked window in the back. That’s what many organizations face today when relyin...

CVE-2025-48414

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface...

CVE-2024-49383

Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 Linux, Windows before build 38690...

CVE-2020-1378

creationtimestamp| type| source ---|---|--- 2025-05-23 05:00:00+00:00| seen| https://projectzero.google/2025/05/the-windows-registry-adventure-7-attack-surface.html 2025-05-23 07:05:54+00:00| seen| https://googleprojectzero.blogspot.com/2025/05/the-windows-registry-adventure-7-attack-surface.html...

CVE-2018-0898

creationtimestamp| type| source ---|---|--- 2025-05-23 05:00:00+00:00| seen| https://projectzero.google/2025/05/the-windows-registry-adventure-7-attack-surface.html 2025-05-23 07:05:54+00:00| seen| https://googleprojectzero.blogspot.com/2025/05/the-windows-registry-adventure-7-attack-surface.html...

CVE-2018-0899

creationtimestamp| type| source ---|---|--- 2025-05-23 05:00:00+00:00| seen| https://projectzero.google/2025/05/the-windows-registry-adventure-7-attack-surface.html 2025-05-23 07:05:54+00:00| seen| https://googleprojectzero.blogspot.com/2025/05/the-windows-registry-adventure-7-attack-surface.html...

CVE-2023-41742

Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent Linux, macOS, Windows before build 30430, Acronis Cyber Protect 15 Linux, macOS, Windows before build 35979...

CVE-2023-0435

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41...

The Windows Registry Adventure #7: Attack surface analysis

Posted by Mateusz Jurczyk, Google Project Zero In the first three blog posts of this series, I sought to outline what the Windows Registry actually is, its role, history, and where to find further information about it. In the subsequent three posts, my goal was to describe in detail how this...

CVE-2021-32756

ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to...

CVE-2020-15378

The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface...

CVE-2025-48414

The eCharge Hardy Barth cPH2 and cPP2 charging stations (specifically version 2.2.0 ) are vulnerable to a trust management issue due to hard-coded credentials in several web interface scripts. These scripts provide access to additional administrative and debug functionality that was likely intend...

Securing RAG: a Risk Assessment and Mitigation Framework

Retrieval Augmented Generation RAG has emerged as the de facto industry standard for user-facing NLP applications, offering the ability to integrate data without re-training or fine-tuning Large Language Models LLMs. This capability enhances the quality and accuracy of responses but also introduc...

kernel: vsock: Keep the binding until socket destruction

A flaw was found in the Linux kernel's virtual socket protocol network driver, where an improperly timed socket unbinding could result in a use-after-free issue. This flaw allows an attacker who can create and destroy arbitrary connections on virtual connections to read or modify system memory,...

Measuring Security in 5G and Future Networks

In today's increasingly interconnected and fast-paced digital ecosystem, mobile networks, such as 5G and future generations such as 6G, play a pivotal role and must be considered as critical infrastructures. Ensuring their security is paramount to safeguard both individual users and the industrie...

Exploring an Untethered, Unified Approach to CTEM

We live in a world where traditional Vulnerability Management VM has become infosec’s version of ‘whack-a-mole’— an attempt to tackle risks that constantly shift, multiply, and morph. As organizations push workloads to the cloud, offer customers digital experiences, or as they build AI-enabled...

Configuring the SSH Service Port Properly

A server typically has multiple NICs and IP addresses. You need to plan IP addresses to determine which ones are used for services or management. Not all IP addresses need to listen on SSH connections. You can specify only some IP addresses to perform SSH connections to reduce the attack surface...

Do Not Enable the Avahi Service

Avahi is a zero-configuration networking implementation, including a system for multicast DNS/DNS-SD service discovery and automatic broadcast. For example, you can connect a server to the network and use Avahi to automatically broadcast network services running on the server for other user to...

Do Not Install the Avahi Service

Avahi is a zero-configuration networking implementation, including a system for multicast DNS/DNS-SD service discovery and automatic broadcast. For example, you can connect a server to the network and use Avahi to automatically broadcast network services running on the server for other user to...

Avoid Using Wireless Networks

If the hardware device contains wireless modules such as Wi-Fi and Wi-Fi is enabled in the system, the server may connect to the network wirelessly. If the connection is not managed, the network may be unstable and the attack surface increases. If no wireless network is used, you are advised to...