Countdown to GDPR: Get 20/20 Visibility Into Your IT Assets

Anyone questioning the importance of IT asset visibility in an organization’s security and compliance postures ought to review the EU’s General Data Protection Regulation GDPR, which goes into effect next year. With the severe requirements the GDPR places on how a business handles the personal da...

Russia Threatens to Ban Telegram Messaging App, Says It Was Used By Terrorists

Russia has threatened to ban Telegram end-to-end encrypted messaging app, after Pavel Durov, its founder, refused to sign up to the country's new data protection laws. Russian intelligence service, the FSB, said on Monday that the terrorists that killed 15 people in Saint Petersburg in April had...

CVE-2017-1326

IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060...

Countdown to GDPR — Reduce your Risk

First discussed in the 1990s and turned into law last year, the EU’s General Data Protection Regulation GDPR finally goes into effect in May 2018, imposing strict requirements on millions of businesses and subjecting violators to severe penalties. The complex regulation is of concern not just to...

5 Questions to Ask Your CISO about the GDPR

The European General Data Protection Regulation GDPR comes into force on May 25, 2018, and it will have a huge impact on the way businesses store and collect personal information belonging to those located in the European Union EU. The regulation applies to all businesses that hold and process da...

VMware vSphere Data Protection Command Execution and Information Disclosure Vulnerabilities

VMware vSphere Data Protection is prone to an arbitrary command-execution and information disclosure vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

VMware vSphere Data Protection 5.x/6.x - Java Deserialization(CVE-2017-4914)

No description provided by source. !/usr/bin/env python import socket import sys import ssl def getHeader: return '\x4a\x52\x4d\x49\x00\x02\x4b' def payload: cmd = sys.argv4 cmdlen = lencmd data2 =...

VMware vSphere Data Protection 5.x / 6.x Java Deserialization

!/usr/bin/env python import socket import sys import ssl def getHeader: return '\x4a\x52\x4d\x49\x00\x02\x4b' def payload: cmd = sys.argv4 cmdlen = lencmd data2 =...

VMware vSphere Data Protection Local Storage vCenter Server Credentials Vulnerability

VMware vSphere Data Protection VDP is a disk-based backup and recovery solution from VMware. Integrated with VMware vCenter Server, the server and virtualization management software, the solution can be used to centrally manage backup jobs while storing backup files in deduplicated target storage...

VMware vSphere Data Protection Remote Code Execution (CVE-2017-4914)

Multiple vulnerabilities have been reported in VMware vSphere Data Protection. The vulnerabilities are due to improper Java deserialization and use of reversible encryption. A remote attacker could exploit one of the vulnerabilities by sending specially crafted data to the targeted server, which...

EMC Data Protection Advisor ImageServlet Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Data Protection Advisor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ImageServlet servlet which listens on TCP ports 9002 and 9004...

VMware vSphere Data Protection 5.x/6.x - Java Deserialization Exploit

Exploit for multiple platform in category remote exploits !/usr/bin/env python import socket import sys import ssl def getHeader: return '\x4a\x52\x4d\x49\x00\x02\x4b' def payload: cmd = sys.argv4 cmdlen = lencmd data2 =...

VMware vSphere Data Protection 5.x/6.x - Java Deserialization

!/usr/bin/env python import socket import sys import ssl def getHeader: return '\x4a\x52\x4d\x49\x00\x02\x4b' def payload: cmd = sys.argv4 cmdlen = lencmd data2 =...

VMware vSphere Data Protection 5.x6.x - Java Deserialization

VMware vSphere Data Protection 5.x6.x - Java Deserialization !/usr/bin/env python import socket import sys import ssl def getHeader: return '\x4a\x52\x4d\x49\x00\x02\x4b' def payload: cmd = sys.argv4 cmdlen = lencmd data2 =...

VMware vSphere Data Protection 5.5.x / 5.8.x / 6.0.x < 6.0.5 / 6.1.x < 6.1.4 Multiple Vulnerabilities (VMSA-2017-0010

The version of VMware vSphere Data Protection installed on the remote host is 5.5.x, 5.8.x, or 6.0.x prior to 6.0.5, or it is 6.1.x prior to 6.1.14. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists when handling Java deserialization that allows an...

Data Anonymization: Motivation and Mechanics

Data is one of the most valuable assets a company has in its possession. And while it may not be listed as a line item on the balance sheet, when a company’s data is breached it can have a very negative impact on the bottom line—in a company’s stock price, reputation and brand. One approach to...

VMware Patches Critical Vulnerabilities in vSphere Data Protection

VMware fixed two critical vulnerabilities in its vSphere Data Protection solution this week that could have allowed an attacker to execute commands on the virtual appliance, among other outcomes. The Department of Homeland Security’s CERT encouraged users and admins on Wednesday to apply the...

CVE-2017-4917

VMware vSphere Data Protection VDP 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained...

Design/Logic Flaw

VMware vSphere Data Protection VDP 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained...

Deserialization of untrusted data

VMware vSphere Data Protection VDP 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance...