CVE-2020-25843

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege...

CVE-2020-25843 CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege...

CVE-2020-25843

CVE-2020-25843 affects NHIServiSignAdapter. The issue is a failure to verify the length of digital credential files’ path, leading to a heap overflow. This could allow remote attackers to execute code without privileges. Some sources list a high/critical impact (network attack, low/unknown auth) ...

h1-ctf: hackyholidays CTF Writeup

Summary: As per the referenced blog entry, the Grinch has gone hi-tech this year with the intentions of ruining the holidays. The challenge was about infiltrating the Grinch's network and take it down. As outlined on https://hackerone.com/h1-ctf, the domain hackyholidays.h1ctf.com was in scope. I...

Taking a Neighborhood Watch Approach to Retail Cybersecurity

Every year retailers face a heightened level of risk during the online holiday shopping season. COVID-19 drastically shifted consumer buying behaviors, forcing retailers to accelerate digital transformation efforts to support an exponentially higher number of online transactions. Projected U.S...

Akamai's Technical Enablement and Education Team, Part of the Global Services and Support Organization, Wins 2020 Chief Learning Officer Magazine Gold Award

On October 2020, the Akamai Technical Enablement and Education TE&E Team -- responsible for creating product-training certifications for employees Global Services and Support GSS, customers Akamai University, and channel partners Advanced Partner Enablement -- won its second industry award for...

Akamai Prolexic and Equinix Cloud Exchange Unite, Bringing DDoS Defense Closer to the Customer Origin

In terms of cyberthreats and digital risk, 2020 has been all about DDoS attacks. We've seen threat actors launch record breaking 1.44 Tbps and 809 Mpps attacks, cybercriminals conduct the largest global DDoS extortion campaign, and a significant uptick in cyberweek DDoS attacker activity aimed at...

Digital Footprint Intelligence Report

Introduction The Digital Footprint Intelligence Service announces the results of research on the digital footprints of governmental, financial and industrial organizations for countries in the Middle East region: Bahrain, Egypt, Iran, Iraq, Jordan, Kuwait, Lebanon, Oman, Qatar, Saudi Arabia, Suda...

Akamai Prolexic and Equinix Cloud Exchange Bring DDoS Defense Closer to the Origin

In terms of cyberthreats and digital risk, 2020 has been all about distributed denial-of-service DDoS attacks...

Windows Digital Media Receiver Privilege Escalation

The vulnerability of the Windows Digital Media Receiver component of the Windows operating system is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...

How Your Digital Trails Wind Up in the Police’s Hands

Phone calls. Web searches. Location tracks. Smart speaker requests. They’ve become crucial tools for law enforcement, while users often are unaware...

Hey Alexa, Who Am I Messaging?

The potential for digital-home assistants like Amazon Alexa to infringe on user privacy by making and saving voice recordings of them is already widely known. Now researchers have discovered that the devices also may be able to “hear” and record what people are typing on nearby smartphones, even...

Launching a New Game Studio and Planning for Growth

So, you're starting your own game studio. This is an incredible opportunity! You and your team get to start fresh and build the game of your dreams! But, let's be honest, if you have just founded your own game studio, odds are that you're not a technical architect. You may have some technical...

A Second Hacker Group May Have Also Breached SolarWinds, Microsoft Says

As the probe into the SolarWinds supply chain attack continues, new digital forensic evidence has brought to light that a separate threat actor may have been abusing the IT infrastructure provider's Orion software to drop a similar persistent backdoor on target systems. "The investigation of the...

SQL Injection Vulnerability in Digital OA (EKP) of Shenzhen Lanling Software Co.

Founded in 2001, BlueLine Software is a professional service provider of digital work and the first strategic partner of AliCloud in the field of knowledge management and collaboration, providing all kinds of organizations with integrated solutions such as intelligent office, mobile portal,...

Security Bulletin: Financial Transaction Manager for Digital Payments is affected by a potential logout session timeout (CVE-2020-4555)

Summary Login session may not be invalidated in a timely manner on timeout. Vulnerability Details CVEID: CVE-2020-4555 DESCRIPTION: IBM Financial Transaction Manager for High Value Payments for Multi-Platform does not invalidate session after logout which could allow an authenticated user to...

5 essential steps needed to set up a secure e-commerce website

By Owais Sultan Here are a few tips for getting your business set up as an e-commerce provider and transferring previous face-to-face clients into digital sales. This is a post from HackRead.com Read the original post: 5 essential steps needed to set up a secure e-commerce website...

Arbitrary File Download Vulnerability in EAP Enterprise Adaptation Management Platform

Ltd. launched a digital intelligent operation management platform, through data governance, modeling analysis and other means to help operators achieve operation monitoring, measurement and analysis, prediction and early warning and other decision-making intelligent assistance, a total of more th...

Help Others Be "Cyber Aware" This Festive Season—And All Year Round!

Are you tired of being the cybersecurity help desk for everyone you know? Are you frustrated with spending all your time securing your corporate environment, only to have to deal with the threat that snuck in through naive end-users? Are you new to security and wondering how you ended up here? Th...

Software Supply-Chain Attack Hits Vietnam Government Certification Authority

Cybersecurity researchers today disclosed a new supply-chain attack targeting the Vietnam Government Certification Authority VGCA that compromised the agency's digital signature toolkit to install a backdoor on victim systems. Uncovered by Slovak internet security company ESET early this month, t...