CVE-2022-42451 HCL BigFix Patch Management is vulnerable to insecurely stored credentials

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user...

CVE-2022-42451

CVE-2022-42451 affects HCL BigFix Patch Management, specifically the Download Plug-ins, where certain credentials are stored insecurely. This could allow a local privileged user to access sensitive credentials, consistent with a Local, Low-Complexity exposure (CVSS v3.1: base score ~4.4–4.6, Conf...

CVE-2022-42451 HCL BigFix Patch Management is vulnerable to insecurely stored credentials

Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user...

PT-2023-14116 · Ibm · Bigfix Patch Management

Name of the Vulnerable Software and Affected Versions: BigFix Patch Management affected versions not specified Description: The issue concerns certain credentials within the BigFix Patch Management Download Plug-ins being stored insecurely. This could potentially expose them to a local privileged...

HCL Technologies BigFix Patch Management Security Vulnerability

HCL Technologies BigFix Patch Management is a comprehensive patch management solution from HCL Technologies, Inc. designed to help organizations effectively manage and deploy security and non-security patches for operating systems and applications. HCL Technologies BigFix Patch Management has a...

Curl 8.4.0 – Proactively Identifying Potential Vulnerable Assets

On Wednesday, October 4, 2023, the curl project maintainers announced pre-notification for curl version 8.4.0 to be released on October 11. This version will fix two new vulnerabilities with one high and one low-severity CVE. The prenotification stated that the high-severity issue is arguably the...

NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations

A plea for network defenders and software manufacturers to fix common problems. EXECUTIVE SUMMARY The National Security Agency NSA and Cybersecurity and Infrastructure Security Agency CISA are releasing this joint cybersecurity advisory CSA to highlight the most common cybersecurity...

Update Chrome now! Google patches another actively exploited vulnerability

Google has updated the Stable Channel for Chrome to 117.0.5938.132 for Windows, Mac and Linux. This update includes ten security fixes. According to Google there is an active exploit for one of the patched vulnerabilities, which means cybercriminals are aware of the vulnerability and are using it...

Mitigating Risk with Custom First-Party Software and Application Components: A CISOs’ Guide

What is First-Party Software Anyway? First-party software, unlike off-the-shelf ‘Third-Party’ software, is custom open-source software OSS and applications created by organizations to stitch together existing software to meet custom business needs. Nearly every company today uses some form of...

Acronis Cyber Protect Security Vulnerability

Acronis Cyber Protect is an all-in-one cyber protection solution for business and enterprise from Acronis Singapore. It combines backup, anti-malware, network security and endpoint management features such as vulnerability assessment, URL filtering, patch management and more. A security...

Risk Fact #5: Keeping the Pace of Remediation at Cloud Scale Requires Automation

Qualys Blog Series – 2023 TotalCloud Security Insights by the Threat Research Unit The 2023 TotalCloud Security Insights report from the Qualys Threat Research Unit TRU provides research insights, best practices, and detailed recommendations organized by five separate Risk Facts. The insights wil...

The main causes of ransomware reinfection

A few months ago, we wrote about a ransomware reinfection incident. Ransomware reinfection arguably could be even worse than being a first time victim. Unfortunately it happens more often than you may think. Research shows that in 2022, more than a third 38% of surveyed organizations fell victim ...

Exchange Server security updates updated

Microsoft has re-released the August 2023 Security Updates SUs for Exchange Server. The original release of the SUs, from August 8 2023, had a localization issue with Exchange Server running on a non-English Operating Systems OSes that caused Setup to stop unexpectedly, leaving Exchange services ...

Cloudflare Tunnel increasingly abused by cybercriminals

Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Cybercriminals are increasingly using this service to keep their activities from being detected. Cloudflare Tunnel, also known by its executable name, Cloudflared,...

2022 Top Routinely Exploited Vulnerabilities

SUMMARY The following cybersecurity agencies coauthored this joint Cybersecurity Advisory CSA: United States: The Cybersecurity and Infrastructure Security Agency CISA, National Security Agency NSA, and Federal Bureau of Investigation FBI Australia: Australian Signals Directorate’s Australian Cyb...

Zimbra issues awaited patch for actively exploited vulnerability

Two weeks ago, we urged readers to apply a workaround for an actively exploited vulnerability in Zimbra Collaboration Suite ZCS email servers. Zimbra has released ZCS 10.0.2 that fixes two security issues, including the known bug that could lead to exposure of internal JSP and XML files. Zimbra i...

Security Patch Management Strengthens Ransomware Defense

With thousands of applications to manage, enterprises need an effective way to prioritize software security patches. That calls for a contextualized, risk-based approach and good overall attack surface risk management...

Third-Party Dependency Vulnerability in Confluence

This high severity Patch Management vulnerability was introduced in version 7.13.15 of Confluence Data Center & Server. This Patch Management vulnerability, with CVSS Scores of 7.5, allows an authenticated attacker to expose assets in your environment susceptible to exploitation which has no...

BlackByte 2.0 Ransomware: Infiltrate, Encrypt, and Extort in Just 5 Days

Ransomware attacks are a major problem for organizations everywhere, and the severity of this problem continues to intensify. Recently, Microsoft's Incident Response team investigated the BlackByte 2.0 ransomware attacks and exposed these cyber strikes' terrifying velocity and damaging nature. Th...

Apple, Google, and MOVEit Just Patched Serious Security Flaws

Plus: Microsoft fixes 78 vulnerabilities, VMWare plugs a flaw already used in attacks, and more critical updates from June...