Announcing the Zero Trust Deployment Center

Organizations have been digitally transforming at warp speed in response to the way businesses operate and how people work. As a result, digital security teams have been under immense pressure to ensure their environments are resilient and secure. Many have turned to a Zero Trust security model t...

Three Cloud-First Akamai Initiatives to Support Your Cloud Journey

61% of organizations plan to focus on cloud migration this year. 93% have a multi-cloud strategy.1 This means that on average your organization is using 2.2 public clouds, multiplying your complexity and your costs. While the cloud has delivered on a lot of promises, it isn't getting simpler or...

Watch Out — Microsoft Warns Android Users About A New Ransomware

Microsoft has warned about a new strain of mobile ransomware that takes advantage of incoming call notifications and Android's Home button to lock the device behind a ransom note. The findings concern a variant of a known Android ransomware family dubbed "MalLocker.B" which has now resurfaced wit...

Three Cloud-First Akamai Initiatives for Your Cloud Journey

According to a 2020 State of the Cloud Report, 61% of organizations plan to focus on cloud migration this year and 93% have a multi-cloud strategy. This means that on average your organization is using 2.2 public clouds, multiplying your complexity and costs...

CloudBees Jenkins Role-based Authorization Strategy Plugin Privilege Obsolete Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Audit Trail Plugin is used in one of the audi...

PT-2020-15516 · Jenkins · Jenkins Role-Based Authorization Strategy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Role-based Authorization Strategy Plugin versions 3.0 and earlier Description: The issue arises from the improper invalidation of a permission cache when the configuration is changed, resulting in permissions being granted based on an...

AMD Radeon Driver Vulnerability - Lenovo Support US

No description provided...

Cloud Networking Operating System (CNOS) Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-44423 Potential Impact: Remote code execution Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2020-8349 Summary Description: An internal security review has identified an unauthenticated remote code execution vulnerability in CNOS’ optional REST A...

AMD Radeon Driver Vulnerability - Lenovo Support US

No description provided...

AMD Radeon Driver Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-48405 Potential Impact: Denial of service Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2020-12911 Summary Description: AMD reported a potential vulnerability in AMD Radeon graphics drivers that could result in denial of service. Mitigation...

NVIDIA GPU Display Driver - September 2020 Security Bulletin - Lenovo Support US

Lenovo Security Advisory: LEN-47663 Potential Impact: Denial of service, code execution, privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2020-5979 , CVE-2020-5980, CVE-2020-5981, CVE-2020-5981 , CVE-2020-5982, CVE-2020-5983,...

System Management Mode (SMM) BIOS Vulnerability in some legacy System x servers - Lenovo Support US

No description provided...

System Management Mode (SMM) BIOS Vulnerability in some legacy System x servers - Lenovo Support US

Lenovo Security Advisory: LEN-38625 Potential Impact: Privilege escalation Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2020-8332 Summary Description: A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and...

Cross-site Scripting (XSS)

jenkins is vulnerable to cross-site scripting XSS. The vulnerability exists through the project naming strategy...

jenkins: stored XSS vulnerability in project naming strategy

A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. The project naming strategy description, displayed on item creation, is not properly escaped. This can result in a stored cross-site scripting XSS vulnerability exploitable by users with Overall/Manage permissions. The highes...

jenkins: stored XSS vulnerability in project naming strategy

A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. The project naming strategy description, displayed on item creation, is not properly escaped. This can result in a stored cross-site scripting XSS vulnerability exploitable by users with Overall/Manage permissions. The highes...

A Patient Dies After Ransomware Attack Paralyzes German Hospital Systems

German authorities last week disclosed that a ransomware attack on the University Hospital of Düsseldorf UKD caused a failure of IT systems, resulting in the death of a woman who had to be sent to another hospital that was 20 miles away. The incident marks the first recorded casualty as a...

Rethinking Defensive Strategy at the Edge, Part 3: Strategies for Protective Action

Our three-part blog series, Re-thinking Defensive Strategy at the Edge, has been focusing on outlining a new defensive edge strategy for today's enterprise. We began with a discussion of data and indicators. Most recently, our second post focused on using risk signals and correlating them for...

Rethinking Defensive Strategy at the Edge, Part 2: Risk Signals as Security Controls

In the first post in our blog series Rethinking Defensive Strategy at the Edge, we began to outline why a new defensive edge strategy is needed for today's enterprise. As previously mentioned, the strategy enhances those in place and introduces another layer of defense that includes the following...

A "DFUR-ent" Perspective on Threat Modeling and Application Log Forensic Analysis

Many organizations operating in e-commerce, hospitality, healthcare, managed services, and other service industries rely on web applications. And buried within the application logs may be the potential discovery of fraudulent use and/or compromise! But, let's face it, finding evil in application...