7419 matches found
Congrats, you got everyone remote. But did you do it securely?
The lockdown has meant entire companies of typically office based staff being forced to work from home. The change to our way of life is like nothing anyone has in living memory ever seen. However, alongside that, IT teams have had to rush to deliver solutions that were simply not designed for th...
SuperMicro Supermicro X10DRH-iT Cross-Site Request Forgery Vulnerability
The SuperMicro Supermicro X10DRH-iT is a server motherboard from SuperMicro USA. A security vulnerability exists in the web interface of the Supermicro X10DRH-iT motherboard BIOS version 2.0a and IPMI firmware version 03.40. The vulnerability can be exploited by a remote attacker to add a new...
CVE-2020-15046
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...
Cross site request forgery (csrf)
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...
CVE-2020-15046
This CVE (CVE-2020-15046) affects Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40. The web interface exposes a CSRF vulnerability in cgi/config_user.cgi that allows remote attacker to add a new admin user, with fixed versions BIOS 3.2 and IPMI firmware 03.88. Evidenced de...
CVE-2020-15046
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...
How to Do Micro-Segmentation the Right Way
Micro-segmentation is the central IT security best practice response to overly-permissive policies. Learn how to do it right...
PT-2020-14142 · Supermicro · Supermicro X10Drh-It
Name of the Vulnerable Software and Affected Versions: Supermicro X10DRH-iT motherboards with BIOS version 2.0a and IPMI firmware version 03.40 Description: The issue allows remote attackers to exploit a CSRF problem in the cgi/config user.cgi file through the web interface, enabling them to add...
Lansweeper 7.2 Default Account / Remote Code Execution
Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...
formula1.it Cross Site Scripting vulnerability OBB-1204073
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
When Security Takes a Backseat to Productivity
"We must care as much about securing our systems as we care about running them if we are to make the necessary revolutionary change." -CIA's Wikileaks Task Force. So ends a key section of a report the U.S. Central Intelligence Agency produced in the wake of a mammoth data breach in 2016 that led ...
SOC 2 Compliance During Covid-19 Times
A lot of IT Security Officers responsible for driving the SOC 2 certification in their companies are probably wondering how the switch to mostly remote workspaces will affect their SOC 2 landscape. I would say that there are two types of companies affected or not affected by the coronavirus:...
Theft of CIA's 'Vault 7' Secrets Tied to 'Woefully Lax" Security
A just-released report on the 2016 Central Intelligence Agency CIA data breach, which led to the Vault 7 document dump on WikiLeaks, blames “woefully lax” security by the nation’s top spy agency. The conclusions were part of an internal 2017 Department of Justice DoJ report on the CIA breach. On...
Shadow IT: Why It’s Still a Major Risk in Today’s Environments
Shadow IT is nothing new. Employees have long adopted software applications or cloud services without the knowledge or approval of their organization’s IT department, most often in search of easier ways to get their jobs done. People typically utilize unsanctioned apps not because they’re seeking...
Lansweeper Command Execution Vulnerability
Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A security vulnerability exists in Lansweeper versions 6.0.x through 7.2.x. The vulnerability can be exploited via the Add New Package and...
Ansible: Multiple vulnerabilities
Background Ansible is a radically simple IT automation platform. Description Multiple vulnerabilities have been discovered in Ansible. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...
Knoxville Ransomware Attack Leads to IT Network Shutdown
The city of Knoxville, Tenn. is reeling from a ransomware attack that knocked the city’s network offline and prevented police officers from responding to non-life-threatening traffic crashes. The incident occurred Wednesday and shuttered systems until Thursday. Also impacted was the city’s intern...
Indian IT Company Was Hired to Hack Politicians, Investors, Journalists Worldwide
A team of cybersecurity researchers today outed a little-known Indian IT firm that has secretly been operating as a global hackers-for-hire service or hacking-as-a-service platform. Based in Delhi, BellTroX InfoTech allegedly targeted thousands of high-profile individuals and hundreds of...
Security Drift – The Silent Killer
Global spending on cybersecurity products and services is predicted to exceed $1 trillion during the period of five years, between 2017 to 2021, with different analysts predicting the Compound Annual Growth Rate CAGR at anywhere between 8 to 15%. It is not surprising to see this growth in spendin...
Why SecOps is (Still) the Future
Editor’s Note: Sam Bocetta, a guest author on the VMware Carbon Black blog, is a freelance journalist specializing in U.S. diplomacy and national security, with emphases on technology trends in cyber warfare, cyber defense, and cryptography. SecOps is not a new idea. Unfortunately, however, it is...