Cloud Data Security is Now Available in AWS Marketplace

We’re pleased to announce that Imperva Cloud Data Security is now available in the Amazon Web Services Marketplace. Database security shouldn’t be hard, so Imperva has made it simple. Imperva Cloud Data Security CDS is a SaaS solution specifically designed to secure organizations’ data stored in...

SQL Injection Vulnerability in Great Intelligence Fire Protection Digital Monitoring Center Platform

Great Wisdom Fire Digital Monitoring Center Platform is a fire IOT remote monitoring system, which is applicable to the smart fire platform under the new smart city, suitable for city networking, industry networking, large enterprise networking and remote unattended places. There is a SQL injecti...

Digital Offense Capabilities Are Currently Net Negative for the Security Ecosystem

Proposition Digital offense capabilities are currently net negative for the security ecosystem.0 The costs of improved digital offense currently outweigh the benefits. The legitimate benefits of digital offense accrue primarily to the security one percent securityonepercent, and to intelligence,...

Can Edge Computing Exist Without the Edge? Part 3: The Economics of Edge Computing

Do the math. For the past decade, digital businesses have been investing in digital transformation initiatives. The promise is to increase top-line growth while maximizing customer lifetime value. As infrastructure improves, IT spending is shifting from the cloud to the edge. But while edge...

Can Edge Computing Exist Without the Edge? Part 3: The Economics of Edge Computing

Do the math. For the past decade, digital businesses have been investing in digital transformation initiatives. The promise is to increase top-line growth while maximizing customer lifetime value. As infrastructure improves, IT spending is shifting from the cloud to the edge. But while edge...

eCommerce Product Catalog < 3.0.18 - CSRF Nonce Bypass

The plugin did not properly check the CSRF nonce in the icorders.save function, which could allow attackers to make a logged in user with the editdigitalorder capability save arbitrary digital orders...

Afternoon Cyber Tea: Evaluating individual and organizational cyber risk in a pandemic

Cybersecurity professionals find themselves in high demand as organizations worldwide continue to grapple with how to secure millions of remote workers. James Turner is an industry analyst at CISO Lens and served as an adjudicator from 2017 to 2019 for the Australian government’s cyber war games:...

Pre-Authorization Limited Arbitrary File Read in Crowd - CVE-2020-36240

The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. h3. Affected versions: version 4.0.4 4.10.0 ≤ versi...

Pre-Authorization Limited Arbitrary File Read in Crowd - CVE-2020-36240

The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. h3. Affected versions: version 4.0.4 4.10.0 ≤ versi...

CVE-2021-27232

The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage...

CVE-2021-27232

The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage...

Stack overflow

The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage...

CVE-2021-27232

The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage...

CVE-2021-27232

The CVE concerns the RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464. The SetCameraConnectionParameter is described as a stack-based buffer overflow, enabling a remote attacker to potentially execute arbitrary attacker-supplied code. Exploitation requires a victim to ...

Pelco Digital Sentry Server Buffer Error Vulnerability

A buffer error vulnerability exists in Pelco Digital Sentry Server that originates when a network system or product performs an operation in memory without properly validating the data boundaries, resulting in an incorrect read or write operation being performed to an associated other memory...

CVE-2021-27232: Out-of-bounds Write

The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage...

PT-2021-17339

Name of the Vulnerable Software and Affected Versions: Pelco Digital Sentry Server version 7.18.72.11464 Description: The issue is related to a stack-based buffer overflow in the SetCameraConnectionParameter of the RTSPLive555.dll ActiveX control. This can be exploited by a remote attacker to...

Talking Emotet’s takedown with Adam Kujawa: Lock and Code S02E02

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Adam Kujawa, security evangelist and director of Malwarebytes Labs, about Emotet, the former public enemy No. 1 in the cybercrime world. What began in 20...

CVE-2021-27197

DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page e.g., with...

CVE-2021-27197

DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page e.g., with...