Is domain name abuse something companies should worry about?

Even though some organizations and companies may not realize it, their domain name is an important asset. Their web presence can even make or break companies. Therefor, "domain name abuse" is something that can ruin your reputation. Losing control There are several ways in which perpetrators can...

Black Hat 2020: Influence Campaigns Are a Cybersecurity Problem

Social media used as a cudgel for nation-states to sway opinion is a cybersecurity threat CISOs can’t ignore — and need to understand better and mitigate against. That’s the message from Renée DiResta, research manager at the Stanford Internet Observatory, who said she is seeing a steady growth a...

The Importance of Culture and Collaboration

I joined Akamai Japan in June 2020. Of course, having worked in technology for my whole career, I already knew of Akamai and our strong reputation. I knew it was an intelligent company, with impressive technology, and - above all - a great story that really inspired me...

Nextcloud: Github wikis are editable by anyone https://github.com/nextcloud/bookmarks/wiki

Github wikis on the following projects https://github.com/nextcloud/bookmarks/wiki can be edited by any logged in user in the system. This poses security and reputation risk for the company. Impact As wikis listed above can be edited by any person on the internet, a malicious actor can accurately...

CVE-2020-3368

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

CVE-2020-3368

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

Input validation

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

CVE-2020-3368 Cisco Email Security Appliance URL Filtering Bypass Vulnerability

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

CVE-2020-3368

The CVE affects Cisco AsyncOS on the Cisco Email Security Appliance (ESA), where an input-validation weakness allows an unauthenticated, remote attacker to bypass URL reputation filters by crafting a URL. The root cause is insufficient URL input validation. Impact is bypass of URL filtering, enab...

CVE-2020-3368: Improper Input Validation

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An...

PT-2020-2977

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA affected versions not specified Description A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software could allow an unauthenticated, remote attacker to bypass the URL reputation filters...

Facebook: Facebook - Reputation Sync For #267890541047618

This bug was reported directly to Facebook...

Pinpoint and Act Upon “Bad Reputation” IPs

There’s no question that today’s cyber attackers use increasingly sophisticated methods in order to disrupt business or steal private data. And faced with so many attacks from various sources, IT professionals are forced to constantly challenge themselves to identify those alerts more critical th...

Planning Ahead to Prevent Vulnerabilities

The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...

Unauthorized Access Vulnerability in Reputation's Backend Operations Management Center

Shenzhen Guo Ren Online Information Technology Co., Ltd. focuses on the traditional small and medium-sized enterprises in China to provide full network marketing, network marketing and promotion, network promotion outsourcing services in Shenzhen network promotion company. Unauthorized access...

Ethical dilemmas with responsible disclosure

We do a LOT of disclosures, probably starting one a day on average. Between us, we spend a man day or so per week just managing disclosures. It creates pain for us and consumes time, particularly when the vendor won’t listen. We get the occasional legal threat, which takes time and money to slap...

Cuvva: Time-limit Bypassing, Rate-limit Bypassing and Spamming at https://ops.cuvva.co

Hello cuvva secteam, Hope you are well and safe Summary When trying to sign in at https://ops.cuvva.com: 1. There is no checking if supplied email is valid before sending login link Note: the sent login links do not work but this bug can be used for spamming any supplied email. 2. The time-limit...

Cisco Email Security Appliance URL Filtering Bypass (cisco-sa-20191120-esa-url-bypass)

According to its self-reported version, Cisco Email Security Appliance ESA is affected by a vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software due to insufficient input validation of URLs. An unauthenticated, remote attacker can exploit this, by crafting the URL in a...

Who’s Behind the ‘Web Listings’ Mail Scam?

In December 2018, KrebsOnSecurity looked at how dozens of U.S. political campaigns, cities and towns had paid a shady company called Web Listings Inc. after receiving what looked like a bill for search engine optimization SEO services rendered on behalf of their domain names. The story concluded...

Identifying Let’s Encrypt Revoked Certificates

Let's Encrypt is a free, automated, open certificate authority CA run for the public's benefit as a service from the Internet Security Research Group ISRG. It provides free digital certificates to enable HTTPS SSL/TLS for websites via user-friendly means. Earlier this week, Let's Encrypt announce...