The vulnerability of the FortiSIEM security management interface arises from the use of a less secure encryption algorithm, which allows attackers to disclose the protected information.

The vulnerability of the FortiSIEM security management interface is related to the use of a less secure encryption algorithm. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

PT-2023-5205 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSIEM versions 6.7.0 through 6.7.5 Description: The issue is related to insufficient protection of service data in the security management system, allowing an attacker to disclose sensitive information via crafted HTTP requests...

Why Now? The Rise of Attack Surface Management

The term "attack surface management" ASM went from unknown to ubiquitous in the cybersecurity space over the past few years. Gartner and Forrester have both highlighted the importance of ASM recently, multiple solution providers have emerged in the space, and investment and acquisition activity...

Cloud Security Tops Concerns for Cybersecurity Leaders: EC-Council's Certified CISO Hall of Fame Report 2023

A survey of global cybersecurity leaders through the 2023 Certified CISO Hall of Fame Report commissioned by the EC-Council identified 4 primary areas of grave concern: cloud security, data security, security governance, and lack of cybersecurity talent. EC-Council, the global leader in...

Exploit for Deserialization of Untrusted Data in Fortra Goanywhere_Managed_File_Transfer

This exploit is a Python script designed to exploit the CVE-2023...

Wyse Management Suite Improper Access Control Vulnerability (CNVD-2025-26825)

Wyse Management Suite is Dell's hybrid cloud security management solution for Wyse thin client devices, designed to simplify IT management processes and enhance device security. An Improper Access Control vulnerability exists in Wyse Management Suite that stems from incorrect access control. No...

Phoenix Contact Classic Line Controllers Insufficient Verification of Data Authenticity (CVE-2022-31800)

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

PT-2025-9693 · Cisco · Cisco Asyncos +1

Name of the Vulnerable Software and Affected Versions: Cisco Content Security Management Appliance SMA affected versions not specified Description: A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Content Security Management Appliance SMA could allow an...

ISO 27001 Certification: What it is and why it matters

Did you know that Rapid7 information security management system ISMS is ISO 27001 certified? This certification validates that our security strategy and processes meet very high standards. It underscores our commitment to corporate and customer data security. What is ISO 27001? ISO 27001 is an...

File Upload Vulnerability in Yisetong Electronic Document Security Management System (CNVD-2022-91374)

Electronic Document Security Management System abbreviation: CDG is an electronic document security protection software, which uses drive layer transparent encryption technology to prevent internal staff from leaking secrets and external personnel from illegally stealing core important data asset...

CVE-2022-24037

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information...

CVE-2022-40751

IBM UrbanCode Deploy UCD 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with administrative privileges including "Manage Security" permissions may be able to recover a credential previously saved for performing...

F5 BIG-IP 跨站请求伪造漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP. An attacker exploited the vulnerability to perform cross-site request forgery via iControl SOAP...

Introducing new Microsoft Defender for Cloud innovations to strengthen cloud-native protections

Security teams face an expanding attack surface as organizations increasingly use cloud-native services to develop, deploy, and manage applications across their multicloud and hybrid environments. Their challenge is compounded by incomplete visibility, siloed processes, and a lack of prioritized...

Trellix ePolicy Orchestrator 跨站脚本漏洞

Trellix ePolicy Orchestrator is a centralized security management platform from Trellix. A security vulnerability exists in Trellix ePolicy Orchestrator. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the vendor announcement...

Multiple Fortinet products vulnerable to information leakage

Fortinet FortiManager and Fortinet FortiAnalyzer, both from Fortinet, are a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. The product is mainly used to collect network log data and analyze, report and archive...

Sensormatic Electronics C-CURE 9000

1. EXECUTIVE SUMMARY CVSS v3 4.3 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls Inc. Equipment: C-CURE 9000 Vulnerability: Observable Response Discrepancy 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

How IT and security teams can work together to improve endpoint security

For executives in the IT and security spaces, the current climate offers reasons to worry. As workers become accustomed to new flexibility in the workplace, hybrid and remote work options present more challenges. Users want to access corporate resources from their own devices without the...

Emerson DeltaV Distributed Control System 信任管理问题漏洞

Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson. The system includes features such as network security management, alarm management, batch control, and change management. The Emerson DeltaV Distributed Control System is vulnerable to a trust...

Ltd. has SQL injection vulnerability in the security management system of Centrin JingYun terminal

Centrin Jing Cloud Terminal Security Management System is an enterprise-level network anti-virus system developed by Beijing Centrin Link Information Technology Co. Ltd. There is a SQL injection vulnerability in the security management system of Centron View Cloud Terminal, which can be exploited...