Aggregator

亚马逊证实在第三方供应商发生安全事故后其员工信息遭到泄露。亚马逊表示它以及 AWS 是安全的，没有发生安全事故。亚马逊称它收到通知，其物业管理供应商发生了安全事故，影响亚马逊在内的多个客户

The security vulnerability is due to an exposed Microsoft Message Queuing (MSMQ) instance and the use of the insecure BinaryFormatter.

We’re honored to share a new partnership with Orange Business (Norway), a global leader in digital services. ARMO

The post ARMO selected by Orange Business to Secure its Managed Kubernetes Services appeared first on ARMO.

The post ARMO selected by Orange Business to Secure its Managed Kubernetes Services appeared first on Security Boulevard.

A vulnerability, which was classified as problematic, has been found in Siemens S7-PCT, Security Configuration Tool, SIMATIC Automation Tool, SIMATIC BATCH V9.1, SIMATIC NET PC Software, SIMATIC PCS, SIMATIC PDM, SIMATIC Route Control , SIMATIC STEP, SIMATIC WinCC OA, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC Unified PC Runtime, SIMATIC WinCC , SINAMICS Startdrive, SINUMERIK ONE Virtual, SINUMERIK PLC Programming Tool, TIA Portal Cloud Connector and Totally Integrated Automation Portal. Affected by this issue is some unknown functionality. The manipulation leads to out-of-bounds read. This vulnerability is handled as CVE-2023-46280. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Linux Kernel up to 6.11.4. This vulnerability affects the function timer_pending of the component USB. The manipulation leads to denial of service. This vulnerability was named CVE-2024-50100. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ch/qos/logback/core/net/ssl/SSL.java of the component Keystore Handler. The manipulation of the argument DEFAULT_KEYSTORE_PASSWORD with the input changeit leads to use of hard-coded password. This vulnerability is handled as CVE-2024-11026. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in OS4Ed openSIS-Classic 9.1 and classified as critical. This vulnerability affects unknown code of the file resetuserinfo.php. The manipulation of the argument username_stn_id leads to sql injection. This vulnerability was named CVE-2024-51211. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in Hoosk 1.7.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file config.php. The manipulation leads to Privilege Escalation. This vulnerability is handled as CVE-2024-51055. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in confidential-containers trustee up to 0.8.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component ART Token Handler. The manipulation leads to improper authentication. This vulnerability is known as CVE-2024-51997. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in hopetree izone c011b48. Affected by this vulnerability is the function push_urls/get_urls of the file \apps\tool\apis\bd_push.py. The manipulation leads to server-side request forgery. This vulnerability is known as CVE-2024-50811. The attack needs to be done within the local network. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in hopetree izone c011b48. Affected by this issue is the function AddCommintView of the file \apps\comment\views.py of the component Article Comment Handler. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-50810. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in SeaCMS 13.1. This affects an unknown part of the file admin_notify.php of the component Notification Module. The manipulation of the argument notify leads to code injection. This vulnerability is uniquely identified as CVE-2024-50808. Access to the local network is required for this attack. There is no exploit available.

A vulnerability classified as problematic has been found in NetApp StorageGRID up to 11.8.x. This affects an unknown part of the component Service. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2024-21994. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

BlackFog launched its next generation enterprise platform to deliver even more powerful ransomware and insider threat prevention. BlackFog’s pioneering platform focuses specifically on anti data exfiltration to prevent unauthorized data from leaving a device, ensuring that an organization’s most sensitive information is protected. The latest product enhancements in Version 5 are designed to provide enhanced data loss prevention without the need for data classification. This comes at a time when ransomware attacks continue to evolve … More →

The post BlackFog platform enhancements boost data loss prevention appeared first on Help Net Security.

User access reviews are periodic evaluations of access rights to ensure they align with users’ roles, reducing security risks and helping maintain regulatory compliance. The main goal of user access reviews is to prevent unauthorized access to sensitive information, systems, or resources by regularly verifying and adjusting user permissions. When and where are UARs needed,...

The post Creating an Effective User Access Review Program in 12 Simple Steps appeared first on Hyperproof.

The post Creating an Effective User Access Review Program in 12 Simple Steps appeared first on Security Boulevard.

Panaseer claims 72% of security leaders are taking out personal indemnity insurance as board scrutiny increases

CISA should make its recommended goals mandatory and perform audits to ensure compliance.