Weak Password Vulnerability in Various Gateways of Mapleton Technology Co.

Mapletree Technology Co., Ltd. is a leading provider of network products and solutions in China. A weak password vulnerability exists in a number of MyPlus Technology's gateways, which can be exploited by an attacker to log in to the backend and obtain sensitive information...

CVE-2019-10200

CVE-2019-10200 affects OpenShift Container Platform 4. By default, users who can create pods may schedule workloads on master nodes. If such pods use hostNetwork on a master node, they can retrieve credentials for the master AWS IAM role, potentially granting management access to AWS resources an...

Unisys Stealth (core) Authorization Issues Vulnerability

The unisys stealthcore is a firewall from Unisys. This firewall is easy to configure and expand, can be upgraded by micro-segmentation, and fully protects internal data security. Unisys Stealth core version 6.0.025.0 previously contained a security vulnerability that could be exploited by a local...

A New Paradigm in Data Security: Insider Risk Management

The pandemic was a force accelerator for digital transformation in the enterprise. It’s not just the dramatic remote work shift — it’s a profound shift toward prioritizing speed and flexibility as the drivers of a company’s competitive advantage. But as faster, more agile ways of working...

PT-2021-2504 · Microsoft · Visual Studio Code Python Extension

Name of the Vulnerable Software and Affected Versions: Visual Studio Code Python Extension affected versions not specified Description: The issue is related to incorrect code generation management in the Microsoft Visual Studio Code Python Extension. Exploitation of this issue may allow a remote...

The vulnerability of the Audio component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Audio component in the Google Chrome browser is related to its use after release. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

NewStart CGSL CORE 5.04 / MAIN 5.04 : shim Vulnerability (NS-SA-2021-0009)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has shim packages installed that are affected by a vulnerability: - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows...

Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jan 2021 CPU)

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210119, 12.2.1.3.x prior to 12.2.1.3.201216, 12.2.1.4.x prior to 12.2.1.4.201216, or 12.2.5.5.x OAS 5.5 prior to 12.2.5.5.201216. It is, therefore,...

Five Ways Bad Bots Are Threatening Financial Services

For years now, the biggest security concerns for businesses in the financial services sector have mainly been related to data security, privacy, compliance and everything in between. Nevertheless, application security is equally as important and complex, as it consists of multiple potential attac...

Anatomy of a Security Super Bowl Dynasty, Part 2: The Offense

Imperva’s Directors of Technology in the Office of the CTO, Brian Anderson and Craig Burlingame, recently conducted an informal education session titled Creating a Security Super Bowl Dynasty. In this presentation, they used examples of how teams create consistent, sustainable success in American...

EulerOS Virtualization for ARM 64 3.0.6.0 : php (EulerOS-SA-2021-1566)

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar...

jenkins: Path traversal vulnerability in agent names

A flaw was found in jenkins. Users with Agent/Configure permissions can choose agent names that cause an override to the global config.xml file. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

CVE-2021-23977

CVE-2021-23977 affects Firefox on Android, a time-of-check-time-of-use vulnerability allowing a malicious app to read sensitive data from other application directories. The issue is limited to Firefox for Android and does not impact other OS variants; affected versions are Firefox

Scammers, profiteers, and shady sites? It must be tax season

US tax season is upon us, a time of the year when a special kind of vermin comes crawling out of the woodwork: tax scammers! Not that their goals are any different from any other scammers. They want your hard-earned dollars in their pockets. Most of the tax-related attacks follow a few tried and...

What’s Different About Data Security in the Cloud? Almost Everything.

Well before the onset of the pandemic most organizations had a digital transformation plan in place which included migrating workloads to new modern architectures, usually a private, public, or hybrid cloud. As the challenges caused by COVID-19 became more acute, these organizations accelerated...

Code injection

Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

Cloud Data Security is Now Available in AWS Marketplace

We’re pleased to announce that Imperva Cloud Data Security is now available in the Amazon Web Services Marketplace. Database security shouldn’t be hard, so Imperva has made it simple. Imperva Cloud Data Security CDS is a SaaS solution specifically designed to secure organizations’ data stored in...

The Coronavirus Pandemic Is Widening the Cybersecurity Skills Gap

While there are undoubtedly many major challenges within the world of cybersecurity, one of the principal roadblocks to the implementation of effective data security is the lack of skilled cybersecurity practitioners. In a November 2019 report, the International Information System Security...

nodejs-dot-prop: prototype pollution

A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto paths. The highest threat from this vulnerability is to data confidentiality and integrity as well a...

How cloud data distracts businesses from correct data security practices

By Waqas Companies are migrating to cloud-based servers to store their data. More than half of all businesses report that their data is stored in the cloud. This is a post from HackRead.com Read the original post: How cloud data distracts businesses from correct data security practices...