4744 matches found
New Highly-Critical SAP Bug Could Let Attackers Take Over Corporate Servers
SAP has patched a critical vulnerability impacting the LM Configuration Wizard component in NetWeaver Application Server AS Java platform, allowing an unauthenticated attacker to take control of SAP applications. The bug, dubbed RECON and tracked as CVE-2020-6287, is rated with a maximum CVSS sco...
Ask Me Anything – Celebrating The Fifth Anniversary Of My Monthly Threat Webinar
In July 2015, I did my first threat webinar. I had planned to do it on a monthly basis, and never imagined I would still be doing it five years later, but here I am, still creating monthly webinars. I still do. I started the webinar series to help people understand the different threats targeting...
Making Azure Sentinel work for you
Microsoft Azure Sentinel is the first Security Incident and Event Management SIEM solution built into a major public cloud platform that delivers intelligent security analytics across enterprise environments and offers automatic scalability to meet changing needs. This new white paper outlines be...
The Only Constant Is Change -- Rethinking Secure Access for a New Workforce
It seems like a long time ago now when IT teams had their annual strategy meeting, where topics related to network modernization with SASE or SD-WANs, remote access, threat prevention, and cloud adoption were likely discussed. COVID-19, however, has caused a lot of these initiatives to take a...
Beyond the Endpoint: Why Organizations are Choosing XDR for Holistic Detection and Response
The endpoint has long been a major focal point for attackers targeting enterprise IT environments. Yet increasingly, security bosses are being forced to protect data across the organization, whether it’s in the cloud, on IoT devices, in email, or on-premises servers. Attackers may jump from one...
Unspecified Vulnerability in Open Solutions for Education openSIS
Open Solutions for Education openSIS is a U.S. Open Solutions for Education, Inc. open source student information management system . A security vulnerability exists in the /Bottom.php script in Open Solutions for Education openSIS 7.4 and earlier versions. An attacker can exploit this...
Unspecified Vulnerability in Open Solutions for Education openSIS (CNVD-2021-19767)
Open Solutions for Education openSIS is a U.S. Open Solutions for Education, Inc. open source student information management system . A security vulnerability exists in Open Solutions for Education openSIS 7.4 and prior versions that stems from improper access control. An attacker could exploit t...
Unspecified Vulnerability in iFAX Solutions HylaFAX+ and HylaFAX Enterprise
iFAX Solutions HylaFAX+ is an open source, enterprise-class send and receive fax system from iFAX Solutions, Inc. The system provides fax functionality for users on a local area network.HylaFAX Enterprise is the commercial version. A security vulnerability exists in iFAX Solutions HylaFAX+ 7.0.2...
Unspecified Vulnerability in iFAX Solutions HylaFAX+ and HylaFAX Enterprise (CNVD-2021-19773)
iFAX Solutions HylaFAX+ is an open source, enterprise-class send and receive fax system from iFAX Solutions, Inc. The system provides fax functionality for users on a local area network.HylaFAX Enterprise is the commercial version. A security vulnerability exists in iFAX Solutions HylaFAX+ 7.0.2...
Best security, compliance, and privacy practices for the rapid deployment of publicly facing Microsoft Power Apps intake forms
With the dawn of the COVID-19 pandemic, state and federal agencies around the globe were looking at ways to modernize data intake for social services recipients. The government of a country of about 40 million citizens reached out to Microsoft and asked us to assist in this endeavor. Going...
SecureAuth IdP Client Template Injection Vulnerability
SecureAuth IdP is a suite of identity management solutions from SecureAuth USA. The product supports features such as two-factor authentication and single sign-on. A security vulnerability exists in the SecureAuth.aspx file in SecureAuth IdP version 9.3.0. An attacker can exploit the vulnerabilit...
Build in the Cloud with Confidence
The AWS Well-Architected Framework provides a consistent approach to building cloud architectures. Learn how to leverage consistent best practices and guidance for your architecture so you can focus on building great solutions in the cloud...
Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2020-4223)
Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2020-4223 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...
A zero-day guide for 2020: Recent attacks and advanced preventive techniques
Zero-day vulnerabilities enable threat actors to take advantage of security blindspots. Typically, a zero-day attack involves the identification of zero-day vulnerabilities, creating relevant exploits, identifying vulnerable systems, and planning the attack. The next steps are infiltration and...
Viki Solutions Viki Vera Code Execution Vulnerability
Viki Solutions Viki Vera is a workflow customization platform from Viki Solutions Canada. The platform supports file uploading, job management, etc. Branding Module is one of the branding modules. A security vulnerability exists in the Branding Module in Viki Solutions Viki Vera version...
CVE-2020-12017
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
CVE-2020-12017
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
Authentication flaw
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
CVE-2020-12017
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...
