768 matches found
Fidelis Network Deception 操作系统命令注入漏洞
Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A security vulnerability exists in Fidelis...
Fidelis Network Deception 操作系统命令注入漏洞
Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. Fidelis Network Deception has a security...
CVE-2021-35050: Storing Passwords in a Recoverable Format
User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versio...
CVE-2021-35048: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception version...
CVE-2021-35047: Improper Neutralization of Special Elements used in an OS Command
Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and...
Fidelis Network 安全漏洞
Fidelis Network Deception is a security product from Fidelis USA. It is used to detect threats and prevent data loss with features such as detecting malicious behavior, identifying traffic anomalies, and automatically responding to advanced threats. A security vulnerability exists in Fidelis...
Urban Company: Broken Link on Urban Company's Vulnerability Submission Form
Summary: - Urban Company has an unclaimed broken link on their HackerOne security page which can be claimed by any malicious user. And then later the malicious user can exploit this issue to deceive new researchers to submit their legitimate findings to the wrong hands. Steps To Reproduce: 1.Visi...
CVE-2021-35047
Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and...
CVE-2021-35050
User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present in Fidelis Network and Deception versio...
CVE-2021-35049
Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated...
CVE-2021-35048
Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception version...
[eBook] 7 Signs You Might Need a New Detection and Response Tool
It's natural to get complacent with the status quo when things seem to be working. The familiar is comfortable, and even if something better comes along, it brings with it many unknowns. In cybersecurity, this tendency is countered by the fast pace of innovation and how quickly technology becomes...
Fake DarkSide Campaign Targets Energy and Food Sectors
Threat actors behind a recent campaign pose as DarkSide in a bid to deceive targets into paying ransom...
Ping Identity: Broken Link on Ping Identity's Vulnerability Submission Form on Hackerone
Summary: Ping Identity has an unclaimed broken link on their HackerOne security page which can be claimed by any malicious user, who could then exploit this issue with clever social engineering to deceive new researchers to submit their legitimate findings to the wrong hands. Similar to this...
Microsoft SharePoint Server Spoofing Vulnerability (CNVD-2021-41123)
Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A spoofing...
华为 LTE USB Dongle 安全漏洞
Huawei LTE USB Dongle is a combination of hardware and software encryption product from Huawei China that plugs into the parallel port of the computer. It protects source code and algorithms from unauthorized use or against piracy threats. A security vulnerability exists in Huawei LTE USB Dongle,...
[Security Nation] How Robert Black Wards Off Cyber-Attackers with Deception Techniques
!\Security Nation\ How Robert Black Wards Off Cyber-Attackers with Deception Techniqueshttps://blog.rapid7.com/content/images/2021/05/securitynationlogo-2.jpg In our latest episode of Security Nation, we talk with Robert Black, Deputy Director of the UK National Cyber Deception Lab, about his wor...
keycloak: Internationalized domain name (IDN) homograph attack to impersonate users
A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity...
Kaspersky: Several domains on kaspersky.com are vulnerable to Web Cache Deception attack
Reported security issue allowed a potential attacker to steal potentially sensitive information of users of a website, because multiple subdomains of the Kaspersky domain were vulnerable to web cache deception attack. In this scenario the user needs to open a phishing link in a web browser. The...