PT-2021-24125

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Cloud Service Appliance EPM CSA affected versions not specified Description: A code injection vulnerability in the Ivanti EPM Cloud Services Appliance CSA allows an unauthenticated user to execute arbitrary code with...

DoD Cloud Computing Impact Levels 4-5

Moving past DoD Impact Level 2 IL2, the logical next step should be IL3; however, IL3 is no longer used by the Department of Defense DoD and has been consolidated into IL4. DoD IL4 is designed to store, process, and transmit up to controlled unclassified information CUI related to military or...

[ADM Cloud] License information is missing on ADM Cloud Service and all managed ADCs enter graceful period

Licenses are missing like below on ADM Cloud Service: And managed ADCs enter graceful period due to no license activation...

Weak Password Vulnerability in TopGate500 of Skyrun Technology Group

Founded in 1995 as the first network security enterprise in China, Skyrun Technology Group has become a leading network security, big data and cloud service provider in China. A weak password vulnerability exists in TopGate500 of Tianrongxin Technology Group, which allows an attacker to log in to...

Requirements for DoD Impact Level 2

As discussed in the previous blog post on FedRAMP+, there are four authorization levels defined in the Department of Defense DoD Cloud Computing CC Security Requirements Guide SRG. In this post we will give a brief rundown of the lowest authorization level, DoD Impact Level IL 2, and the security...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21083

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

Improper access control

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

Cross site scripting

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084 Adobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code execution

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

CVE-2021-21084

CVE-2021-21084 covers a stored XSS vulnerability in Adobe Experience Manager (AEM). Affected are Cloud Service and on‑prem versions 6.5.7.0 and below, 6.4.8.3 and below, and 6.3.3.8 and below. The flaw affects the resource resolver factory and could allow an attacker to inject malicious JavaScrip...

CVE-2021-21083

Adobe Experience Manager CVE-2021-21083 affects AEM Cloud Service and on-prem versions 6.5.7.0 and earlier, 6.4.8.3 and earlier, and 6.3.3.8 and earlier, due to an improper access control in the DSRPReindexServlet that can be exploited by an unauthenticated attacker to cause a denial-of-service i...

The vulnerabilities of operating systems such as iOS, iPadOS, macOS, tvOS, the browser Safari, the multimedia player iTunes, and the iCloud service allow attackers to compromise the integrity of protected information.

The vulnerabilities of operating systems such as iOS, iPadOS, macOS, tvOS, the browser Safari, the multimedia player iTunes, and the iCloud service are related to the implementation of incorrect control flow. Exploiting these vulnerabilities allows a malicious actor to influence the integrity of...

CVE-2021-3039

An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log...

5 #TrendTips To Build Better in the Cloud

You have multiple cloud service provider accounts and you want to make sure that you are deploying everything in a well-architected fashion to avoid future security headaches. Here's where to begin...

5 questions to answer before spending big on cloud security

Do your tool diligence Convincing people to sign off on big cloud security spends is, most assuredly, a never-ending process. Because every so often be it in 6 months, 1 year, 2 years, your security organization will have to pitch to the check-writers all over again. Of course, we all know it’s...

Unauthorized Access Vulnerability in Baidu.com Windows Version

Baidu.com is a cloud service product. An unauthorized access vulnerability exists in the Windows version of Baidu.com. An attacker can exploit the vulnerability by restarting Baidu.com to bypass the "lock" feature...

Coalfire ramps up for StateRAMP — What you need to know…

There has been a lot of buzz during the past year or so about StateRAMP SR. SR was an idea born out of helping state and local governments efficiently and effectively verify cybersecurity and manage third-party risk. SR is a 501-c6 non-profit, membership-based organization based in Indiana and...

Cloudera Data Engineering Information Disclosure Vulnerability

Cloudera Data Engineering is a service-less architecture cloud service from Cloudera, USA that supports the creation of Apache Spark tasks on a cloud platform. A security vulnerability exists in Cloudera Data Engineering CDE version 1.3.0 that stems from a JWT authentication token being exposed t...