Top 10 Azure Cloud Configuration Mistakes

Trend Micro Research determined the top 10 Azure services with the highest configuration rates...

openSUSE 15 Security Update : php7 (openSUSE-SU-2021:2575-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2575-1 advisory. - Tenable.sc leverages third-party software to help provide underlying functionality. Multiple third-party components were found to contain...

Taiwan Secom Personnel Attendance Management Trust Management Issue Vulnerability

Taiwan Secom Personnel Attendance Management is an attendance management system from Taiwan Secom, China. Trust Management issue vulnerability, the vulnerability originates from the system using hard code admin default credentials, remote attackers can use the vulnerability to access the system...

Default credentials

Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission...

CVE-2021-35961 TAIWAN SECOM CO., LTD., Door Access Control and Personnel Attendance Management system - Use of Hard-coded Credentials

Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission...

CVE-2021-35961: Use of Hard-coded Credentials

Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the system through the default password and obtain the highest permission...

getBalanceLocked on line 202 of Visor.sol doesn't return the total balance, just the highest balance

Handle Sherlock Vulnerability details Impact Causes some internal miscalculations allowing people to take out locked funds using timeUnlockERC20 and delegatedTransferERC20 Proof of Concept Tools Used Hardhat Recommended Mitigation Steps Calculate balance using balance.add lockData.balance on line...

DEBIAN-CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

Bundler 安全漏洞

Bundler is a software application. It provides a consistent environment for Ruby projects by tracking and installing the exact gem and version required. A security vulnerability exists in Bundler versions 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16, which stems from the fact that dependency...

File Containment Vulnerability in netcall of Hangzhou Xinzhongda Technology Co.

netcall is based on the open source communication protocol xmpp development of instant messaging software . A file inclusion vulnerability exists in netcall of Hangzhou New CU Technology Co. Ltd, which can be exploited by an attacker to obtain the highest privileges on the system...

Microsoft Security: 6 tips for enabling people-centric cybersecurity with security training

Everyone knows about phishing scams, and most of us think we’re too smart to take the bait. Our confidence often reaches superhero levels when we’re logged onto a company network. As Chief Security Advisor for Microsoft, and previously at telco Swisscom, it’s my business to understand how well...

B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution

!/usr/bin/env python3 -- coding: utf-8 -- B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution Vendor: B-Swiss SARL | b-tween Sarl Product web page: https://www.b-swiss.com Affected version: 3.6.5 3.6.2 3.6.1 3.6.0 3.5.80 3.5.40 3.5.20 3.5.00 3.2.00 3.1.00 Summary: Intelligent...

CVE-2020-14015

An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system will allow an unauthorized user to continue setting a...

CVE-2018-20225

An issue was discovered in pip all versions because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not...

PT-2020-8665 · Pip +1 · Pip +1

Name of the Vulnerable Software and Affected Versions: pip all versions Description: An issue was discovered in pip because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the...

PYSEC-2020-87

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level...

Directory traversal

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the...

CVE-2017-9385

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows the highest privileges a user can obtain on the device. This web interface uses root as the username and the password in the...

CISO series: Secure your privileged administrative accounts with a phased roadmap

In my role, I often meet with CISOs and security architects who are updating their security strategy to meet the challenges of continuously evolving attacker techniques and cloud platforms. A frequent topic is prioritizing security for their highest value assets, both the assets that have the mos...

CVE-2016-9498: Deserialization of Untrusted Data

ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application...