Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in a PAN-OS web interface administration page. Ref. PAN-93242; CVE-2018-9337 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML An attacker would need to successfully authenticate prior to exploiting...

Cross-Site Scripting (XSS) in PAN-OS Management Web Interface

A Cross-Site Scripting XSS vulnerability exists in the PAN-OS session browser. Ref. PAN-93244; CVE-2018-9335 Successful exploitation of this issue may allow an attacker to inject arbitrary JavaScript or HTML. An attacker would need to successfully authenticate prior to exploiting this issue. This...

Security Bulletin: Vulnerability in SSLv3 affects IBM Storwize V7000 Unified (CVE-2014-3566)

Summary There are security vulnerabilities in SSLv3 that is shipped with IBM Storwize V7000 Unified. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote use...

Security Bulletin: Vulnerability in SSLv3 affects IBM SONAS (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM SONAS. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information, caus...

CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings...

Design/Logic Flaw

DISPUTED A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default...

CVE-2018-12048

CVE-2018-12048 concerns Canon LBP7110Cw: a remote attacker can bypass Management Mode on the web interface without a PIN by abusing /checkLogin.cgi in conjunction with /portal_top.html to gain full device access. Affected product: Canon LBP7110Cw web UI; vulnerability described as an authenticati...

CVE-2018-12049

A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default setting...

CVE-2018-12048

A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings...

Building a Profitable Security Services Offering

Security is the number one concern of business owners today. This isn’t surprising, with all of the hacks, breaches, data thefts, ransomware attacks and privacy violations that we hear about on a daily basis. And those are just the ones we know about – according to the Online Trust Alliance’s OTA...

CVE-2018-11711

A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the...

CVE-2018-11711

A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the...

CVE-2018-11711

CVE-2018-11711 describes a remote bypass of System Manager Mode on Canon MF210/MF220 web interfaces. An unauthenticated attacker can access without a PIN by leveraging vectors involving /portal_top.html (and related /login.html) to obtain full device access. Exploitation is demonstrated in public...

GDPR Is Here: Assess Risk from Vendors and from Internal Teams

Organizations must manage risk from third parties such as contractors and suppliers, and from internal staffers and teams, as part of their compliance program for the EU’s General Data Protection Regulation GDPR. The need to manage vendor risk in particular is stressed repeatedly throughout the...

How To Prioritize Vulnerabilities in a Modern IT Environment

Here’s a stat that shows the importance of prioritizing vulnerability remediation: Almost 30% of the CVEs disclosed in 2017 had a CVSS score of “High” or “Critical.” That works out to about 3,000 such vulnerabilities, or about 58 every week. Given this large number of severe vulnerabilities, it’s...

Facebook Introduces “Clear History” Option Amid Data Scandal

Facebook unveiled new updates to its social-media platform this week aimed at securing private data – including a new privacy control called “Clear History.” CEO Mark Zuckerberg outlined the new data privacy measure in a post. Clear History essentially brings the capabilities that users are...

Samples of SiliVaccine Offer Rare Peek Inside North Korea’s Antivirus Software

Two aged samples of North Korean antivirus software called SiliVaccine crib software code from a competitor and come loaded with malware and a backdoor. The two SiliVaccine samples obtained by researchers at Check Point security offer unique insight into a secretive country and how it likely...

Protecting the Veeam Backup & Replication server

Purpose This article provides information about protecting the Veeam Backup & Replication Configuration. This addresses the frequently asked question: "How do I back up or protect the Veeam Server?" The only supported way to protect the configuration of Veeam Backup & Replication is to use the...

Cisco Wireless LAN Controller Default Simple Network Management Protocol Community Strings

With new installations of Cisco Wireless LAN Controller Software, the installation scripts create default communities for Simple Network Management Protocol SNMP Version 2 SNMPv2 and a default username for SNMP Version 3 SNMPv3, both allowing for read and write access. As documented in the Cisco...

Indication of Compromise: Another Key Practice for GDPR Compliance

In this ongoing blog series on preparing for complying with the EU’s General Data Protection Regulation GDPR, we’ve explained the importance of having solid, foundational security practices like asset management and threat prioritization. Today, we’ll discuss how another such practice can help...