The Pitfalls of DIY Security for Your AWS RDS Databases

AWS RDS enables easy DIY database provisioning The trend toward using Database as a Service DBaaS is unmistakable. Organizations are leveraging DBaaS flexibility to bring new products and services to market faster, or to save time and money by reducing the cost and complexity of their database...

CVE-2021-1412

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only...

Web shell attacks continue to rise

One year ago, we reported the steady increase in the use of web shells in attacks worldwide. The latest Microsoft 365 Defender data shows that this trend not only continued, it accelerated: every month from August 2020 to January 2021, we registered an average of 140,000 encounters of these threa...

UBUNTU-CVE-2021-21126

Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension...

vCISO Shares Most Common Risks Faced by Companies With Small Security Teams

Most companies with small security teams face the same issues. They have inadequate budgets, inadequate staff, and inadequate skills to face today's onslaught of sophisticated cyberthreats. Many of these companies turn to virtual CISOs vCISOs to provide security expertise and guidance. vCISOs are...

The vulnerability in the web interface of the Cisco Finesse automation software allows a malicious individual to gain unauthorized access to the OpenSocial Gadget Editor.

The vulnerability in the web interface for controlling the automation tools of Cisco Finesse’s operator software relates to the lack of protective measures for the web page structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the...

DEBIAN-CVE-2020-16027

Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension...

Feds: K-12 Cyberattacks Dramatically on the Rise

The feds have warned that cyberattacks on the K-12 education sector are ramping up alarmingly. In an alert from the FBI and the Cybersecurity and Infrastructure Security Agency CISA, officials said that data from the Multi-State Information Sharing and Analysis Center MS-ISAC shows that in August...

Consul's Health Check API Endpoints May Disclose Information

Summary Consul and Consul Enterprise “Consul” did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. This vulnerability affected Consul versions 1.4.1 through 1.6.2 and was assigned CVE-2020-7955. Background Consul uses Access Control...

The Future of Remote Work: Connecting Security and IT — Webinar Highlights

The unforeseen global health crisis of 2020 has driven radical changes in most organizations. With empty offices and business pressure building, enterprises are forced to rapidly adapt to new working environments. Almost all non-essential employees are now working remotely, and this trend is like...

UBUNTU-CVE-2020-15963

Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension...

SecOps Teams Wrestle with Manual Processes, HR Gaps

Only about half of enterprises are satisfied with their ability to detect cybersecurity threats, according to a survey from Forrester Consulting – with respondents painting a picture of major resource and technology gaps hamstringing their efforts to block cyberattacks. According to the...

Cloud Security Gaps and Misconfigurations May be Lurking

While moving to remote work, your organization was probably focused on simply getting up and running—willing to accept a degree of risk. Now that you are adjusted to remote work, you could be faced with unexpected security gaps as a result...

The vulnerability in the web interface of the Cisco DNA Center allows a attacker to perform cross-site scripting attacks.

The vulnerability of the Cisco DNA Center’s web interface is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the Microsoft .NET Framework software lies in its lack of proper input validation, allowing attackers to execute arbitrary code.

The vulnerability of the Microsoft .NET Framework software exists due to insufficient testing of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file from a remote location...

Thinking of a Cybersecurity Career? Read This

Thousands of people graduate from colleges and universities each year with cybersecurity or computer science degrees only to find employers are less than thrilled about their hands-on, foundational skills. Heres a look at a recent survey that identified some of the bigger skills gaps, and some...

chromium-browser: Insufficient policy enforcement in payments

Insufficient policy enforcement in payments in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

DEBIAN-CVE-2020-6482

Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

DEBIAN-CVE-2020-6486

Insufficient policy enforcement in navigations in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

The vulnerability of the NIO-infrastructure client/server architecture for Java Netty, related to the inconsistent interpretation of http requests, allows attackers to compromise data integrity.

The vulnerability of the NIO-server/client infrastructure for Java Netty is related to improper handling of double colon gaps in HTTP headers. Exploiting this vulnerability allows a remote attacker to compromise data integrity...