operating systems such as Data Compromise

The vulnerabilities of operating systems such as iOS, iPadOS, macOS, tvOS, the browser Safari, the multimedia player iTunes, and the iCloud service are related to the implementation of incorrect control flow. Exploiting these vulnerabilities allows a malicious actor to influence the integrity of...

CVE-2021-3039

An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role of the authenticated user is logged to a debug log file. Authenticated Operator role and Auditor role users with access to the debug log...

5 #TrendTips To Build Better in the Cloud

You have multiple cloud service provider accounts and you want to make sure that you are deploying everything in a well-architected fashion to avoid future security headaches. Here's where to begin...

5 questions to answer before spending big on cloud security

Do your tool diligence Convincing people to sign off on big cloud security spends is, most assuredly, a never-ending process. Because every so often be it in 6 months, 1 year, 2 years, your security organization will have to pitch to the check-writers all over again. Of course, we all know it’s...

Unauthorized Access Vulnerability in Baidu.com Windows Version

Baidu.com is a cloud service product. An unauthorized access vulnerability exists in the Windows version of Baidu.com. An attacker can exploit the vulnerability by restarting Baidu.com to bypass the "lock" feature...

Coalfire ramps up for StateRAMP — What you need to know…

There has been a lot of buzz during the past year or so about StateRAMP SR. SR was an idea born out of helping state and local governments efficiently and effectively verify cybersecurity and manage third-party risk. SR is a 501-c6 non-profit, membership-based organization based in Indiana and...

Cloudera Data Engineering Information Disclosure Vulnerability

Cloudera Data Engineering is a service-less architecture cloud service from Cloudera, USA that supports the creation of Apache Spark tasks on a cloud platform. A security vulnerability exists in Cloudera Data Engineering CDE version 1.3.0 that stems from a JWT authentication token being exposed t...

CVE-2021-21083

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the...

Can security and compliance for managed database services be simple?

Actual Tech Media recently released a new entry in its Gorilla Guide series for IT professionals, focused on simplifying security and compliance for Database as a Service DBaaS. The Gorilla Guide To® Securing Database as a Service DBaaS features Imperva Cloud Data Security as a solution to help...

Cisco Umbrella DoS

The vulnerability of the Cisco Umbrella security cloud service web interface is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause a service failure remotely...

Beijing Legendary Huayu Education Technology Co., Ltd. digital resources cloud service platform has a logic flaw vulnerability

Beijing Legendary Huayu Education Technology Co., Ltd. is a company focusing on the role and development of unstructured data management and application in education and teaching. A logic flaw vulnerability exists in the digital resources cloud service platform of Beijing Legendary Huayu Educatio...

Quali CloudShell Cross-Site Scripting Vulnerability (CNVD-2021-06529)

Quali CloudShell is a cloud service from Quali USA for managing infrastructure provisioning, cloud orchestration, automated deployments and more in cloud environments. A cross-site scripting vulnerability exists in Quali CloudShell version 9.3 that originates on the login page and can be exploite...

CVE-2020-27488

Loxone Miniserver devices with firmware before 11.1 aka 11.1.9.3 are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices or attackers who are spoofing these devices can continue to use an unauthenticated cloud service for an...

CVE-2020-27488

Loxone Miniserver devices with firmware before 11.1 aka 11.1.9.3 are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices or attackers who are spoofing these devices can continue to use an unauthenticated cloud service for an...

Authentication flaw

Loxone Miniserver devices with firmware before 11.1 aka 11.1.9.3 are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices or attackers who are spoofing these devices can continue to use an unauthenticated cloud service for an...

CVE-2020-27488

The CVE concerns Loxone Miniserver devices with firmware before 11.1 (11.1.9.3) that cannot use an authentication method based on the update package signature. This enables continued use of an unauthenticated cloud service by spoofed devices until a device is updated. Once a device’s firmware is ...

CVE-2020-27488: Improper Authentication

Loxone Miniserver devices with firmware before 11.1 aka 11.1.9.3 are unable to use an authentication method that is based on the "signature of the update package." Therefore, these devices or attackers who are spoofing these devices can continue to use an unauthenticated cloud service for an...

PT-2021-11397

Name of the Vulnerable Software and Affected Versions: Loxone Miniserver versions prior to 11.1 Description: The issue affects devices that cannot use an authentication method based on the signature of the update package. As a result, these devices, or attackers spoofing them, can continue to use...

Loxone Miniserver 授权问题漏洞

Loxone Miniserver is a server that provides energy management and monitoring functions for automation of equipment and homes in buildings and houses by Loxone Corporation. Loxone Miniserver version 11.1.9.3 previously had an authorization issue vulnerability that arose from the inability of devic...

Bohan Weiye (Beijing) Technology Co., Ltd. community arterial property management integrated management and control cloud service platform has logic flaws and vulnerabilities

Bohanweiye Beijing Technology Co., Ltd. is a comprehensive solution provider of mobile Internet of Things IoT. A logic flaw exists in the Community Artery Property Management Integrated Control Cloud Service Platform of Bohan Weiye Beijing Technology Co. An attacker can use the vulnerability to l...