WavPack ParseWave64HeaderConfig Heap Overflow DoS

The vulnerability of the ParseWave64HeaderConfig function in the wave64.c component of the WavPack audio codec is related to the use of previously uninitialized variables. Exploiting this vulnerability allows a remote attacker to trigger a service failure using a malicious .wav file...

Microsoft is a Leader in the 2021 Forrester Endpoint Security Software as a Service Wave

We are excited to share that Microsoft has been named a Leader in The Forrester Wave: Endpoint Security Software as a Service, Q2 20211, receiving one of the highest scores in the strategy category and among the top three scores in the current offering category. Forrester notes that “the focus on...

Microsoft is a Leader in the 2021 Forrester Endpoint Security Software as a Service Wave

We are excited to share that Microsoft has been named a Leader in The Forrester Wave: Endpoint Security Software as a Service, Q2 20211, receiving one of the highest scores in the strategy category and among the top three scores in the current offering category. Forrester notes that “the focus on...

Microsoft recognized as a Leader in The Forrester Wave™: Unstructured Data Security Platforms, Q2 2021

In this new world of hybrid work, organizations face an increasing volume of data, ever-evolving regulations around how that data is protected, and an evolving complexity and frequency of data security breaches. To help our customers navigate this complex data landscape, we are focused on...

Command Execution Vulnerability in Wave ClusterEngine (CNVD-2021-39845)

Wave ClusterEngine is a job management software customized for Wave Tissot series HPC products. A command execution vulnerability exists in Wave ClusterEngine, which can be exploited by an attacker to execute arbitrary commands...

UBUNTU-CVE-2021-20309

A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to...

Weak Password Vulnerability in Management System of Wave Group Ltd.

The business of Wave Group Limited covers cloud data center, cloud service big data, smart city, smart enterprise and other business segments, forming a total solution service capability covering four levels: infrastructure, platform software, data information and application software, etc. A wea...

MDR Vendor Must-Haves, Part 9: Assigned Analyst Pods and Security Program Advisors

This blog post is part of an ongoing series about evaluating Managed Detection and Response MDR providers. For more insights, check out our guide, “10 Things Your MDR Service Must Do.” Every organization is unique, with different goals, missions, security maturities, staffing models, technologies...

Forrester names Microsoft a Leader in the 2021 Enterprise Email Security Wave

Today, organizations face an evolving threat landscape and an exponentially increasing attack surface. Email represents the primary attack vector for cybercrime, and security teams are in search of efficient and cost-effective means to minimize the risk of these threats and the impact they have o...

The UNC2529 Triple Double: A Trifecta Phishing Campaign

In December 2020, Mandiant observed a widespread, global phishing campaign targeting numerous organizations across an array of industries. Mandiant tracks this threat actor as UNC2529. Based on the considerable infrastructure employed, tailored phishing lures and the professionally coded...

PT-2021-6031

Name of the Vulnerable Software and Affected Versions IDEMIA Morpho Wave Compact versions prior to 2.6.2 IDEMIA VisionPass versions prior to 2.6.2 IDEMIA Sigma devices versions prior to 4.9.4 IDEMIA MA VP MD devices versions prior to 4.9.7 Description The issue is related to a buffer overflow in...

PT-2021-6028

Name of the Vulnerable Software and Affected Versions IDEMIA Morpho Wave Compact and VisionPass devices versions prior to 2.6.2 Description The issue is related to a buffer overflow in Thrift command handlers, which can be exploited by physically proximate authenticated attackers to achieve code...

PT-2021-6029

Name of the Vulnerable Software and Affected Versions IDEMIA Morpho Wave Compact and VisionPass devices versions prior to 2.6.2 Description The issue is related to a path traversal in Thrift command handlers, allowing remote authenticated attackers to achieve denial of services and information...

Command Execution Vulnerability in Wave ClusterEngine (CNVD-2021-30860)

Wave ClusterEngine is a job management software customized for Wave Tissot series HPC products. A command execution vulnerability exists in Wave ClusterEngine. An attacker can exploit this vulnerability to gain server privileges...

WordPress 5.6-5.7 - Authenticated XXE Within the Media Library Affecting PHP 8

Description A user with the ability to upload files like an Author can exploit an XML parsing issue in the Media Library leading to XXE attacks. WordPress used an audio parsing library called ID3 that was affected by an XML External Entity XXE vulnerability affecting PHP versions 8 and above. Thi...

CVE-2021-26805

Buffer Overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service DoS by running the application with a malicious WAV file...

Command Execution Vulnerability in Wave ClusterEngine (CNVD-2021-30110)

Wave ClusterEngine is a job management software customized for Wave Tissot series HPC products. A command execution vulnerability exists in Wave ClusterEngine, which can be exploited by an attacker to gain server control privileges...

Unauthorized Access Vulnerability in Wave ClusterEngine

Wave ClusterEngine is a job management software customized for Wave Tissot series HPC products. An unauthorized access vulnerability exists in Wave ClusterEngine, which can be exploited by attackers to obtain sensitive information...

Information Disclosure Vulnerability in TSCE of Wave Group Ltd.

Wave owns three listed companies, namely Wave Information, Wave Software and Wave International, and its business covers four industry clusters, namely cloud data center, cloud service big data, smart city and smart enterprise. An information disclosure vulnerability exists in TSCE of Wave Group...

Rapid7 Recognized as a Strong Performer in the Inaugural Forrester Wave™ for MDR, Q1 2021

Independent research firm cites Rapid7 MDR’s “security professionals with extensive incident response and threat hunting experience” delivering a “white-glove, behavioral detection-inspired” service. Detection and response is a critical component to any security program, but standing up an...