Automated remediation level 1: Lock down fundamentals

Non-calamitous conclusions When teams work in silos, they often can have different interpretations of the same data. There’s no way to leverage the real benefits of automated remediation if this is your reality. Ensuring visibility across teams is a critical component in a shared data set where...

SUSE: Security Advisory (SUSE-SU-2020:0278-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Intel® VTune™ Profiler Advisory

Summary: A potential security vulnerability in the Intel® VTune™ Profiler may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-0077 Description: Insecure inherited permissions in the installer for t...

Krane - Kubernetes RBAC Static Analysis And Visualisation Tool

Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its definition. Features RBAC Risk rules - Krane...

The vulnerability of the IBM Security Guardium security tool, related to deficiencies in the error reporting mechanism, allows attackers to gain unauthorized access to the protected information.

The vulnerability of the IBM Security Guardium security tool is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability could allow an unauthorized attacker to gain unauthorized access to the protected information...

How the Biden Administration's cybersecurity order will affect companies

“It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security.” The Biden Administration recently issued Executive Order EO 14028, “Improving the Nation’s Cybersecurity,” to...

Boss of ATM Skimming Syndicate Arrested in Mexico

Florian "The Shark" Tudor, the alleged ringleader of a prolific ATM skimming gang that siphoned hundreds of millions of dollars from bank accounts of tourists visiting Mexico over the last eight years, was arrested in Mexico City on Thursday in response to an extradition warrant from a Romanian...

CVE-2021-22142

Kibana contains an embedded version of the Chromium browser that the Reporting feature uses. An attacker potentially is able to leverage known Chromium vulnerabilities to conduct further attacks...

Elastic Stack 7.13.0 and 6.8.16 Security Update

Kibana url redirection flaw ESA-2021-12 An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website. Affected Versions: All versions of Kibana before 7.13....

Elastic Kibana 安全特征问题漏洞

Elastic Kibana is an application from the Dutch company Elastic. A free and open user interface that enables you to visualize Elasticsearch data and lets you navigate through the Elastic Stack. A security feature issue vulnerability exists in Elastic Kibana, which stems from an embedded version...

CVE-2017-17677

BMC Remedy 9.1SP3 is affected by authenticated code execution. Authenticated users that have the right to create reports can use BIRT templates to run code...

Apple Censorship and Surveillance in China

Good investigative reporting on how Apple is participating in and assisting with Chinese censorship and surveillance...

BMC Remedy 9.1SP3 安全漏洞

BMC Software BMC Remedy 9.1SP3 is an application from BMC Software, Inc. It provides off-the-shelf IT Information Library ITIL service support functionality. A security vulnerability exists in BMC Remedy 9.1SP3, which can be exploited by an attacker to run code using a BIRT template...

The vulnerability in the “Export to Reporting and Analytics” sub-component of the Oracle Hospitality Inventory Management component of the Oracle Food and Beverage Applications suite allows a malicious individual to gain unauthorized access to the device.

The vulnerability of the “Export to Reporting and Analytics” sub-component of the Oracle Hospitality Inventory Management component in the Oracle Food and Beverage Applications suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operatin...

Report to Your Management with the Definitive 'Incident Response for Management' Presentation Template

Security incidents occur. It's not a matter of 'if' but of 'when.' There are security products and procedures that were implemented to optimize the IR process, so from the 'security-professional' angle, things are taken care of. However, many security pros who are doing an excellent job in handli...

IBM Jazz Reporting Service Server-Side Request Forgery Vulnerability

IBM Jazz Reporting Service helps you quickly and easily integrate data from a variety of data sources across your tools and projects, and provides a set of ready-to-use reports for sharing information about your lifecycle management projects. A server-side request forgery vulnerability exists in...

CVE-2021-20535

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834...

CVE-2021-20535

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834...

Server side request forgery (ssrf)

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 198834...

CVE-2021-20535

IBM Jazz Reporting Service is affected by CVE-2021-20535, impacting versions 6.0.6.1, 7.0, 7.0.1, and 7.0.2. The vulnerability is a server-side request forgery (SSRF) that could allow an authenticated attacker to issue unauthorized requests from the vulnerable system, potentially enabling network...