Why SaaS opens the door to so many cyber threats (and how to make it safer)

Cloud services have become increasingly important to many companies' daily operations, and the rapid adoption of web apps has allowed businesses to continue operating with limited productivity hiccups, even as global coronavirus restrictions have forced much of the world to work from home. But at...

Should cloud service providers be concerned with FIPS 140-3?

If youve dealt with FedRAMP, you may already know that FIPS 140-2 is the standard for cryptographic modules published by the National Institute of Standards and Technology NIST. All cloud service providers CSPs who wish to be FedRAMP compliant must use only crypto modules that have been validated...

The HITRUST shared responsibility matrix – the assessor’s point of view

HITRUST® announced the availability of the new Shared Responsibility Program and MatrixTM Version 1.0 to help communicate and assign security and privacy responsibilities between cloud service providers CSPs and their customers. Coalfire is proud that we helped develop the Matrix as part of the...

“World’s most secure online backup” provider exposes 135M records

By Waqas “The World’s Most Secure Online Backup” cloud service. leaks secure backup - Oh, the irony. This is a post from HackRead.com Read the original post: "World’s most secure online backup" provider exposes 135M records...

Veeam Agent backup job configuration fails with "Xml node is not found. Name: [lsObjectRepository]."

Challenge When configuring a Veeam Agent job to target a Veeam Cloud Connect repository, at the Credentials step of the configuration wizard, the following error occurs: Failed to get Cloud Connect repositories, Failed to retrieve the list of available cloud resources from the service provider. X...

Calling for security research in Azure Sphere, now generally available

Today, Microsoft released Azure Sphere into General Availability GA. Azure Sphere’s mission is to empower every organization on the planet to connect and create secured and trustworthy IoT devices. Azure Sphere is an end-to-end solution for securely connecting existing equipment and for creating...

Calling for security research in Azure Sphere, now generally available

Today, Microsoft released Azure Sphere into General Availability GA. Azure Sphere’s mission is to empower every organization on the planet to connect and create secured and trustworthy IoT devices. Azure Sphere is an end-to-end solution for securely connecting existing equipment and for creating...

BCM Messenger: API - Amazon S3 bucket misconfiguration

Dear, BCM Messenger Description My discovering was starting from com.bcm.messenger, First, i trace what application send and receive from the network so i use Frida tool to bypass SSL pinning, Then i was able to trace application http traffic, and since API data is not encrypted and there's nothi...

Unspecified vulnerability in F5 BIG-IP ASM (CNVD-2019-47430)

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A security vulnerability exists in F5 BIG-IP ASM version 15.0.1 that stems from the program not...

SQL Injection Vulnerability in Catapult OA Mobile Cloud Office System

Catapult OA mobile cloud office system, the use of industry-leading cloud computing technology, based on the traditional Internet and mobile Internet, innovative cloud services + cloud terminal application mode, for enterprise users to provide an account management aggregation application service...

Unauthorized access vulnerability in Baidu's Tiangong Intelligence Platform (CNVD-2019-34656)

Baidu Tiangong Intelligence Platform is a cloud service platform for the IoT field, which communicates through mainstream IoT protocols e.g., MQTT, allowing IoT projects to be built between smart devices and the cloud. An unauthorized access vulnerability exists in the Baidu Tiangong Intelligent...

Denial of Service Vulnerability in Baidu's Skyworks Intelligence Platform

Baidu Tiangong Intelligence Platform is a cloud service platform for the IoT field, which communicates through mainstream IoT protocols e.g., MQTT, allowing IoT projects to be built between smart devices and the cloud. There is a denial-of-service vulnerability in the Baidu Skyworks Intelligent...

Unauthorized access vulnerability in Baidu's Tiangong Intelligence Platform ( CNVD-2019-34660)

Baidu Tiangong Intelligence Platform is a cloud service platform for the IoT field, which communicates through mainstream IoT protocols e.g., MQTT, allowing IoT projects to be built between smart devices and the cloud. An unauthorized access vulnerability exists in the Baidu Tiangong Intelligent...

Starbucks: Subdomain takeover of d02-1-ag.productioncontroller.starbucks.com

Summary: I was able to claim the subdomain: d02-1-ag.productioncontroller.starbucks.com using Azure Cloud Service Platforms Affected: Subdomain Azure Cloud Service Steps To Reproduce: 1. Using dig, I was able to determine that the subdomain 'd02-1-ag.productioncontroller.starbucks.com' was...

Information Disclosure in WildFire Appliance (WF-500)

Palo Alto Networks has determined that the WildFire Appliance WF-500 is affected by the vulnerability disclosure known as LazyFP and has completed an update to address these issues. The WildFire Appliance WF-500 software update is now available to customers that use the WildFire Appliance WF-500...

Design/Logic Flaw

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that the user actually owns the camera other than knowing the...

CVE-2019-5625

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

Authentication flaw

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

CVE-2019-5625 Eaton Halo Home Android App Insecure Storage

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

CVE-2019-5625

CVE-2019-5625 affects the Android Halo Home app prior to 1.11.0, where OAuth authentication and refresh tokens are stored in a clear text file. The file persists until logout or device reboot, enabling an attacker with physical access or a compromised app to impersonate the user by reusing the to...