Post-Pandemic world, Shut-downs, and Web Security Connections

As the anniversary of the World Health Organization’s WHO declaration of the COVID-19 pandemic approaches, we, here in Silicon Valley, have great hope for 2021. As the vaccine distribution continues to trickle to Main Street, Californians have recently exited a stay-at-home mandate that has nearl...

Security Bulletin: IBM SDK Java Quarterly Oct 2020 Vulnerabilities Affect IBM Transformation Extender

Summary There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020 - Includes Oracle Oct 2020 CPU minus CVE-2020-14782 that affect IBM Transformation Extender. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Produc...

Recent enhancements for Microsoft Power Platform governance

An emerging trend in digital transformation efforts has been the rise of low-code development platforms. Of course, these low-code platforms must be grounded in best-of-breed governance capabilities which include security and compliance features. Without strong governance, the full benefits of...

Recent enhancements for Microsoft Power Platform governance

An emerging trend in digital transformation efforts has been the rise of low-code development platforms. Of course, these low-code platforms must be grounded in best-of-breed governance capabilities which include security and compliance features. Without strong governance, the full benefits of...

CVE-2021-21266 XXE vulnerability in OpenHAB

openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity XXE attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from th...

Security Bulletin: IBM SDK Java Quarterly CPU Jul 2020 Vulnerabilities Affect IBM Transformation Extender

Summary There are vulnerabilities in IBM SDK, Java Technology Edition Quarterly CPU - Jul 2020 - Includes Oracle Jul 2020 CPU plus one additional vulnerability that affect IBM Transformation Extender. Vulnerability Details CVEID: CVE-2020-14579 DESCRIPTION: An unspecified vulnerability in Java SE...

2021 KuppingerCole Leadership Compass names Imperva an overall leader for Database and Big Data Security

It is my pleasure to report that in their 2021 overview of the market for Database and Big Data Security solutions, leading technology analyst KuppingerCole has identified Imperva as an Overall Leader for the first time. Imperva scored five out of five for product security, functionality,...

Congratulations to 2020 Akamai Partners of the Year

Last year proved to be a year like no other. We faced unforeseen challenges, including adjusting to a new way of working, collaborating, and conducting business. It is an honor for me to announce the Akamai Partners of the Year for 2020 who went above and beyond in this tumultuous year. These...

The vulnerability in the implementation of the Punycode sequence transformation method in Mozilla Firefox browsers allows attackers to perform spamming attacks.

The vulnerability of the Punycode sequence transformation method implemented in Mozilla Firefox browsers is related to the lack of a mechanism for checking input data. Exploiting this vulnerability allows attackers who operate remotely to carry out spam attacks...

The vulnerability of Firefox, Firefox ESR, and the Thunderbird email client relates to the use of memory after transformation with XSL, allowing an attacker to execute arbitrary code.

The vulnerability of Firefox, Firefox ESR, and the email client Thunderbird is related to the use of memory after transformation using XSL. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-03041)

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct cross-site scripting attacks by using th...

Open-xchange OX App Suite 跨站脚本漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct cross-site scripting attacks by using th...

What’s New in InsightAppSec and tCell: Q4 2020 in Review

It’s crazy to believe 2020 has come to an end, and we’re sure we’re not alone in our excitement for 2021! Without a doubt, 2020 has presented some challenges for us all in the security world, as many companies quickly adopted a work-from-home model and pivoted from an in-store experience quickly ...

Forcepoint and Microsoft: Risk-based access control for the remote workforce

This blog post is part of the Microsoft Intelligence Security Association MISA guest blog series. Learn more about MISA here. Adopting cloud-based services as part of an organization’s digital transformation strategy is no longer optional, its a necessity. Last year, only 18 percent of the...

Forcepoint and Microsoft: Risk-based access control for the remote workforce

This blog post is part of the Microsoft Intelligence Security Association MISA guest blog series. Learn more about MISA here. Adopting cloud-based services as part of an organization’s digital transformation strategy is no longer optional, its a necessity. Last year, only 18 percent of the...

phpMyAdmin 4.9.0 < 4.9.6 / 5.0.0 < 5.0.3 Multiple Vulnerabilities (PMASA-2020-5, PMASA-2020-6)

According to its self-reported version, the phpMyAdmin application hosted on the remote web server is 4.9.x prior to 4.9.6 or 5.0.x prior to 5.0.3. It is, therefore, affected by multiple vulnerabilities. - phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature...

Taking a Neighborhood Watch Approach to Retail Cybersecurity

Every year retailers face a heightened level of risk during the online holiday shopping season. COVID-19 drastically shifted consumer buying behaviors, forcing retailers to accelerate digital transformation efforts to support an exponentially higher number of online transactions. Projected U.S...

The vulnerability of the nsTArray Length() function in browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows a malicious actor to cause a service failure.

The vulnerability of the nsTArray Length function in browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to the use of memory after document processing using the XSLT eXtensible Stylesheet Language Transformations language. Exploiting this vulnerability can allow a...

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities.

Summary IBM Cloud Transformation Advisor has addressed the following vulnerabilities: CVE-2020-8251, CVE-2020-8201, CVE-2020-8252 Vulnerability Details CVEID: CVE-2020-8251 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by delayed unfinished HTTP/1.1 requests submission. An...

Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js vulnerability

Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2020-8277 Vulnerability Details CVEID: CVE-2020-8277 DESCRIPTION: Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker could...