Microsoft to acquire RiskIQ to strengthen cybersecurity of digital transformation and hybrid work

Organizations are increasingly using the cloud to reimagine every facet of their business. Hybrid work has accelerated this digital transformation, and customers are challenged with the increasing sophistication and frequency of cyberattacks. Today, Microsoft is announcing that we have entered in...

Microsoft to acquire RiskIQ to strengthen cybersecurity of digital transformation and hybrid work

Organizations are increasingly using the cloud to reimagine every facet of their business. Hybrid work has accelerated this digital transformation, and customers are challenged with the increasing sophistication and frequency of cyberattacks. Today, Microsoft is announcing that we have entered in...

XML Entity Injection Vulnerability in UFIDA U8+ CRM Customer Relationship Management Software

formerly known as Shanghai Qitong Software Co., Ltd., is a management digital service company that integrates the development, consulting, marketing, training, implementation and service of management software and Internet applications. An XML entity injection vulnerability exists in UFIDA U8+ CR...

Securing the Supply Chain: Lessons Learned from the Codecov Compromise

Supply chain attacks are all the rage these days. While they’re not a new part of the threat landscape, they are growing in popularity among more sophisticated threat actors, and they can create significant system-wide disruption, expense, and loss of confidence across multiple organizations,...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

✍️ Description pimcore is a Open Source Data & Experience Management Platform PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce this package is vulnerable for Stored XSS thru gender tag 🕵️‍♂️ Proof of Concept 💥 Impact This vulnerability is capable of stored xss 📍 Location Gender.phpL21...

Weak password vulnerability in Tianwen's service governance platform

Tianwen Digital Media Technology Beijing Co., Ltd. is a state-controlled national high-tech enterprise and Zhongguancun high-tech enterprise. A weak password vulnerability exists in Tianwen's service governance platform, which can be exploited by attackers to obtain sensitive information...

Arbitrary File Deletion Vulnerability in Library Cluster Management System of Guangzhou Tutron Computer Software Development Co. Ltd (CNVD-2021-51296)

Guangzhou Tutron Computer Software Development Co., Ltd. is the leader of all kinds of library service systemization construction software, is a high-tech enterprise integrating consulting service, product development, application integration, digital resource service, form design and technical...

Accessibility and usability for all in Azure Sentinel

As a father of a child on the Autism spectrum who relies completely on digital media for his learning, I fully appreciate the impact that digital accessibility can have on people with disabilities. Designing with accessibility in mind greatly expands the impact of Microsoft solutions. What many...

Accessibility and usability for all in Azure Sentinel

As a father of a child on the Autism spectrum who relies completely on digital media for his learning, I fully appreciate the impact that digital accessibility can have on people with disabilities. Designing with accessibility in mind greatly expands the impact of Microsoft solutions. What many...

Huawei EulerOS: Security Advisory for python-ecdsa (EulerOS-SA-2021-2161)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Western Digital Users Face Another RCE

Bad news comes in threes, most particularly for Western Digital customers. As if things weren’t bad enough for the untold number of Western Digital customers whose data blinked out of existence last month, there’s another zero-day waiting for whoever can’t or won’t upgrade its My Cloud storage...

Preparing for your migration from on-premises SIEM to Azure Sentinel

The pandemic of 2020 has reshaped how we engage in work, education, healthcare, and more, accelerating the widespread adoption of cloud and remote-access solutions. In today’s workplace, the security perimeter extends to the home, airports, the gym—wherever you are. To keep pace, organizations...

Weak Password Vulnerability in DCFW-1800 Series Next-Generation Firewall of Digital China Cloud Computing

DCFW-1800 series next-generation firewalls identify thousands of network applications and provide detailed application risk analysis and flexible policy control. Weak password vulnerability exists in DCFW-1800 series next-generation firewalls, where attackers utilize weak passwords to log into th...

Another 0-Day Looms for Many Western Digital Users

Some of Western Digitals MyCloud-based data storage devices. Image: WD. Countless Western Digital customers saw their MyBook Live network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown...

Mongolian Certificate Authority Hacked to Distribute Backdoored CA Software

In yet another instance of software supply chain attack, unidentified hackers breached the website of MonPass, one of Mongolia's major certificate authorities, to backdoor its installer software with Cobalt Strike binaries. The trojanized client was available for download between February 8, 2021...

PT-2021-7663 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud devices before OS5 Description: The issue allows REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation. This can potentially lead to the execution of arbitra...

PT-2021-7664 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud devices before OS5 Description: The issue is related to incorrect cryptographic signature verification in the Western Digital MyCloud PR4100 firmware. This could allow a remote attacker to execute arbitrary code. The...

Western Digital WD My Book Live Operating System Command Injection Vulnerability

Western Digital WD My Book Live is a network storage device from Western Digital. An operating system command injection vulnerability exists in all versions of Western Digital WD My Book Live. A remote attacker could exploit this vulnerability to execute commands...

Embracing Mobile-First for a Secure Office Anywhere

Shortly after the onset of the pandemic, Asavie -- now part of Akamai -- announced a partnership with Nokia's Nuage Networks to enable the Finnish company to resell what is now Akamai Security and Personalization Services SPS, a product designed to enable private network access for mobile devices...

Unauthorized Access Vulnerability in RICOH Aficio MP C305 at Ricoh (China) Investment Co.

Ricoh China Investment Co., Ltd. provides services and solutions such as document output management services and IT solutions such as office image processing equipment e.g., MFPs, printers, etc., production digital printers, and more. An unauthorized access vulnerability exists in the RICOH Afici...