982 matches found
Account Persistence – Certificates
It is not uncommon organizations to implement an internal certification authority in order to establish trust between entities users, computers etc. or utilize it for… Continue reading - Account Persistence - Certificates...
OpenSSL: ECDSA Private Key Leak (CVE-2011-1945) - Linux
OpenSSL leaks ECDSA private key through a remote timing attack. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...
How to prepare for CMMC compliance as a defense industrial base supplier using the Microsoft cloud
In 2020, the US Department of Defense DoD began the phased rollout of a new framework for protecting their supply chain, known as the defense industrial base DIB. This new Cybersecurity Maturity Model Certification1 CMMC system requires regular audits that will bolster the security of the DIB,...
Get Lifetime Access to 24 Professional Cybersecurity Certification Prep Courses
Not all heroes wear capes. Cybersecurity professionals are digital warriors who use their knowledge and skill to battle malicious hackers. Sounds like an exciting career, right? If the comic-book comparisons aren't working for you, perhaps some figures will. According to ZipRecruiter, the average...
kernel security, bug fix, and enhancement update
4.18.0-305.12.14.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...
A week in security (July 26 – August 1)
Last week on Malwarebytes Labs: OSX.XLoader hides little except its main purpose: What we learned in the installation process. The Clubhouse database “breach” is likely a non-breach. Here’s why. Kaseya Unitrends has unpatched vulnerabilities that could help attackers expand a breach. UDP Technolo...
5GAA & Global Certification Forum Connect on New Cert.
The Global Certification Forum GCF and the 5G Automotive Association 5GAA announced their collaboration on a new program that will support the drive for interoperability, reliability, and safety of up and coming C-V2X systems...
CoolCollege has an information breach
CoolCollege is a course service platform tailored for various companies. The software enhances learning efficiency and more through 36 scenarios such as course creation, assignment tracking, data analysis, and job certification. An information disclosure vulnerability exists in CoolCollege, which...
Microsoft Signed Malware That Spreads Through Gaming
Microsoft signed a driver being distributed within gaming environments that turned out to be a malicious network filter rootkit. G DATA malware analyst Karsten Hahn first noticed the rootkit, publicly posting the find on June 17 and simultaneously reaching out to Microsoft. Hahn noted that the co...
SUSE: Security Advisory (SUSE-SU-2020:0568-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Unspecified Vulnerability in Red Hat-certification
Red Hat Certification is a software package from Red Hat USA. A security vulnerability exists in Red Hat-certification 7 that allows an unauthenticated user to invoke the "restart" RPC method on any accessible host. An attacker could exploit this vulnerability to cause a denial of service...
Unspecified vulnerability in Red Hat-certification (CNVD-2021-40152)
Red Hat Certification is a software package from Red Hat USA. A security vulnerability exists in Red Hat-certification 7, which can be exploited by attackers to gather sensitive information...
RedHat redhat-certification authorization issue vulnerability
Red Hat Certification is a software package from Red Hat USA. A security vulnerability exists in redhat-certification 7 that allows an unauthenticated user to invoke the "restart" RPC method on any accessible host. An attacker could exploit this vulnerability to cause a denial of service...
Redhat redhat-certification access control error vulnerability (CNVD-2021-40155)
Red Hat Certification is a software package from Red Hat USA. An access control error vulnerability exists in Redhat redhat-certification 7 that stems from the component not restricting access to files in the update results page. An attacker could exploit this vulnerability to delete any file...
Redhat redhat-certification access control error vulnerability
Red Hat Certification is a software package from Red Hat USA. An Access Control Error vulnerability exists in Redhat redhat-certification 7 that stems from an inability to properly limit the number of recursive definitions of entities in an XML document. An attacker could exploit the vulnerabilit...
Researchers Demonstrate 2 New Hacks to Modify Certified PDF Documents
Cybersecurity researchers have disclosed two new attack techniques on certified PDF documents that could potentially enable an attacker to alter a document's visible content by displaying malicious content over the certified content without invalidating its signature. "The attack idea exploits the...
SOC 2 Type 2 Guide⚠️: Compliance and Certification — Part 1
SOC 2 Type 2 Guide⚠️: Compliance and Certification — Part 1 First part. Learn about SOC 2 compliance. Why it matters when choosing a SaaS provider. Protect your clients’ privacy Every day, the way we use the internet continues to evolve. And as a result, it’s now easier for people to access their...
CVE-2018-10866
It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him...
CVE-2018-10868
redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host...