Breaking down NOBELIUM’s latest early-stage toolset

As we reported in earlier blog posts, the threat actor NOBELIUM recently intensified an email-based attack that it has been operating and evolving since early 2021. We continue to monitor this active attack and intend to post additional details as they become available. In this blog, we highlight...

Calling for cybersecurity in infrastructure modernization

Yesterday, Rapid7 sent a group letter urging the Biden Administration and Congress to work together to integrate cybersecurity into infrastructure legislation. The letter was signed by 19 companies, industry associations, and nonprofit groups who collaborated on the recommendations. The letter...

Imperva® Opens the first dedicated DDoS scrubbing center in Santiago, Chile

Imperva is excited to be further expanding our presence in Latin America by launching a new Point of Presence PoP in Santiago, Chile, in partnership with leading Chilean Telecommunications provider Entel Corporations. Located within Entel’s gold-standard Ciudad de Los Valles datacenter, which has...

The Wages of Password Re-use: Your Money or Your Life

When normal computer users fall into the nasty habit of recycling passwords, the result is most often some type of financial loss. When cybercriminals develop the same habit, it can eventually cost them their freedom. Our passwords can say a lot about us, and much of what they have to say is...

Microsoft Warns of 25 Critical Vulnerabilities in IoT, Industrial Devices

Security researchers at Microsoft are warning the industry about 25 as-yet undocumented critical memory-allocation vulnerabilities across a number of vendors’ IoT and industrial devices that threat actors could exploit to execute malicious code across a network or cause an entire system to crash...

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

Microsoft’s Section 52, the Azure Defender for IoT security research group, recently uncovered a series of critical memory allocation vulnerabilities in IoT and OT devices that adversaries could exploit to bypass security controls in order to execute malicious code or cause a system crash. These...

NVMS ABB Ability Ellipse APM Cross Site Scripting Vulnerability

NVMS ABB Ability Ellipse APM is an application from NVMS Thailand. It provides operational status and performance insights to prevent critical asset failures while optimizing asset lifecycle costs. Ellipse APM versions prior to 5.3.0.1, 5.2.0.3, and 5.1.0.6 are vulnerable to a cross-site scriptin...

Hacking Operational Technology for Defense: Lessons Learned From OT Red Teaming Smart Meter Control Infrastructure

High-profile security incidents in the past decade have brought increased scrutiny to cyber security for operational technology OT. However, there is a continued perception across critical infrastructure organizations that OT networks are isolated from public networks—such as the Internet. In...

The vulnerability of Microprogrammed Wi-Fi router software from NETGEAR models D6200, D7000, R6020, R6080, R6050, and JR6150 lies in the lack of protection for operational data. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of NETGEAR Wi-Fi router microprogramming systems, such as D6200, D7000, R6020, R6080, R6050, and JR6150, stems from the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of...

SAP warns of malicious activity targeting unpatched systems

A timely warning to keep systems patched has appeared, via a jointly-released report from Onapsis and SAP. The report details how threat actors are “targeting and potentially exploiting unprotected mission-critical SAP applications”. Some of the vulnerabilities used were weaponised fewer than 72...

The vulnerability of microprogrammed software in NETGEAR controllers such as WC7500, WC7600, WC7600v2, and WC9500 lies in the lack of protection for operational data, allowing unauthorized access to the protected information.

The vulnerability of the microprogrammed software of NETGEAR controllers WC7500, WC7600, WC7600v2, and WC9500 lies in the lack of protection for operational data. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

The vulnerability of the Citrix XenMobile Server, a system for managing corporate mobile devices, lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Citrix XenMobile Server, a system for managing corporate mobile devices, is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server, related to security flaws in data protection, allows attackers to gain unauthorized access to protected information.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the lack of protection for operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Operational Decision Manager (Oct 2020 and Jan 2021 CPUs)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 and 8 that is used by IBM Operational Decision Manager ODM. These issues were disclosed as part of the IBM Java SDK updates in October 2020 and and in January 2021. Vulnerability Details CVEID: CVE-2020-147...

The vulnerability of Power BI report servers, related to the lack of protection for operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of Power BI report servers lies in the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Guardrails to Avoid Cloud Misconfigurations

The stakes and opportunities are higher than ever to ensure that strong operational excellence strategies are implemented. Explore how to help ensure you are holding up your end of the bargain as part of your CSP’s Shared Responsibility Model...

Cybozu Office Operation Restriction Bypass Vulnerability (CNVD-2021-18064)

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operational restriction bypass vulnerability exists in the workflow in Cybozu Office. An attacker could exploit the vulnerability to alter workflow data without proper privileges...

JVN#45797538: Multiple vulnerabilities in Cybozu Office

Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below. CyVDB-1657 Operational restrictions bypass vulnerability in Scheduler CWE-264 - CVE-2021-20624 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N| Base Score: 4.3 CVSS v2|...

Cybozu Office 安全漏洞

Cybozu Office is a Web-based, cross-platform collaboration solution from Cybozu. An operational restriction bypass vulnerability exists in the workflow in Cybozu Office. An attacker could exploit the vulnerability to alter workflow data without proper privileges...

Siemens LOGO! 8 BM

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...