Enforce and Report on PCI DSS v4 Compliance with Rapid7
The PCI Security Standards Council (PCI SSC) is a global forum that connects stakeholders from the payments and payment processing industries to craft and facilitate adoption of data security standards and relevant resources that enable safe payments worldwide. According to the PCI SSC website,...
7.3AI Score
A new approach to Browser In The Browser (BITB) without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft. This POC code is built for using this new BITB with Evilginx, and a Microsoft Enterprise phishlet. Before diving deep into this, I.....
6.7AI Score
Andrew Appel shepherded a public comment--signed by twenty election cybersecurity experts, including myself--on best practices for ballot marking devices and vote tabulation. It was written for the Pennsylvania legislature, but it's general in nature. From the executive summary: We believe that...
7.4AI Score
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That...
7.5CVSS
6.4AI Score
0.0005EPSS
Amazon Linux 2 : edk2 (ALAS-2024-2502)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2502 advisory. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which...
9.8CVSS
8.8AI Score
0.106EPSS
Issue Overview: A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to...
9.8CVSS
8.4AI Score
0.106EPSS
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with.....
7.5CVSS
7.5AI Score
0.013EPSS
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with.....
7.5CVSS
7.5AI Score
0.013EPSS
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with.....
7.5CVSS
7.5AI Score
0.013EPSS
Badgerboard: A PLC backplane network visibility module
Analysis of the traffic between networked devices has always been of interest since devices could even communicate with one another. As the complexity of networks grew, the more useful dedicated traffic analysis tools became. Major advancements have been made over the years with tools like Snort...
6.8AI Score
openSUSE: Security Advisory for ca (SUSE-SU-2023:3454-1)
The remote host is missing an update for...
7.5AI Score
Update to CKBI 2.64 from NSS 3.95 Removed: Certificate "E-Tugra Certification Authority" Certificate "Hongkong Post Root CA 1" Certificate "Symantec Class 1 Public Primary Certification Authority - G6" Certificate "Symantec Class 2 Public Primary Certification Authority - G6" Certificate...
7.4AI Score
Over on Lawfare, Jim Dempsey published a really interesting proposal for software liability: "Standard for Software Liability: Focus on the Product for Liability, Focus on the Process for Safe Harbor." Section 1 of this paper sets the stage by briefly describing the problem to be solved. Section...
7.5AI Score
Privacy information management system considerations for ISO 42001
Organizations that want to pursue ISO 42001 certification and have an existing ISO management system in place need to consider how to integrate an AI management system with their current management system to ensure common objectives and obligations are maintained. The following blog post explores.....
7AI Score
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of....
9.8CVSS
9.4AI Score
0.001EPSS
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of....
9.8CVSS
9.6AI Score
0.001EPSS
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of....
9.8CVSS
7.5AI Score
0.001EPSS
A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of....
9.8AI Score
0.001EPSS
Improving Cybersecurity: Different Certifications Explained
In the ever-evolving landscape of cybersecurity, the choice of cryptographic algorithms and certificates plays a pivotal role in ensuring the confidentiality and integrity of sensitive information. While traditional methods such as the RSA public-key cryptosystem have been the cornerstone of...
7.3AI Score
In October, the Consumer Financial Protection Bureau (CFPB) proposed a set of rules that if implemented would transform how financial institutions handle personal data about their customers. The rules put control of that data back in the hands of ordinary Americans, while at the same time...
7AI Score
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature
Summary The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system....
9.8CVSS
7.9AI Score
0.002EPSS
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature
Summary The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system....
9.8CVSS
7.9AI Score
0.002EPSS
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...
9.8CVSS
9.7AI Score
0.002EPSS
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...
9.8CVSS
8.1AI Score
0.002EPSS
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...
9.8CVSS
9.8AI Score
0.002EPSS
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...
9.8CVSS
8.1AI Score
0.002EPSS
CVE-2024-23827 Nginx-UI arbitrary file write through the Import Certificate feature
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...
9.8CVSS
10AI Score
0.002EPSS
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...
9.8CVSS
8.1AI Score
0.002EPSS
Malwarebytes wins every MRG Effitas award for 2 years in a row
ThreatDown Endpoint Protection (EP) achieved the highest possible score (100%) and received certifications for Level 1, Exploit, Online Banking, and Ransomware in the most recent anti-malware efficacy assessment results for the Q3 2023 evaluation performed by MRG Effitas, a world leader in...
6.8AI Score
update to CKBI 2.64 from NSS 3.95 updated: Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" removed old certificates: Certificate "E-Tugra Certification Authority" Certificate "Hongkong Post Root CA 1" Certificate "Symantec Class 1 Public Primary Certification...
7.3AI Score
certification-ameublement.fcba.fr Cross Site Scripting vulnerability OBB-3839549
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...
6.2AI Score
How CISOs’ Roles – and Security Operations – Will Change in 2024
It’s fair to say that 2023 was a turning point for the cybersecurity industry, and no one felt it more than the CISO. From the onslaught of ransomware and zero-day attacks, to the SEC’s new reporting rules, and added to technological innovation and sprawl, CISOs have never been under more pressure....
7.5AI Score
Listening in at Latimer House. RF emissions and more
Loose lips sink ships, loose tweets sink fleets. Intelligence, espionage, technological advancements and other learnings from our annual company conference at the historic and underappreciated Latimer House. “Loose lips [might] sink ships” was a phrase used in UK propaganda posters in WWII. It...
6.6AI Score
Albanian Parliament and One Albania Telecom Hit by Cyber Attacks
The Assembly of the Republic of Albania and telecom company One Albania have been targeted by cyber attacks, the country's National Authority for Electronic Certification and Cyber Security (AKCESK) revealed this week. "These infrastructures, under the legislation in force, are not currently...
7.2AI Score
US pharmacy Rite Aid banned from operating facial recognition systems
Pharmacy chain Rite Aid has been denied the right to run facial recognition systems in its stores for five years, by a Federal Trade Commission (FTC) ruling. The regulator found so many flaws in the retailer's surveillance program that it concluded Rite Aid had failed to implement reasonable...
6.9AI Score
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate...
7.5CVSS
7.1AI Score
0.0005EPSS
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate...
7.5CVSS
0.0005EPSS
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate...
7.5CVSS
6.7AI Score
0.0005EPSS
A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate...
7.4CVSS
7.4AI Score
0.0005EPSS
Siemens SCALANCE W1750D Devices Improper Input Validation (CVE-2023-0286)
A vulnerability exists in the OpenSSL that affects SCALANCE W1750D device. A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an...
7.4CVSS
7.7AI Score
0.003EPSS
BlueNoroff: new Trojan attacking macOS users
We recently discovered a new variety of malicious loader that targets macOS, presumably linked to the BlueNoroff APT gang and its ongoing campaign known as RustBucket. The threat actor is known to attack financial organizations, particularly companies, whose activity is in any way related to...
7.1AI Score
5.3CVSS
6.2AI Score
0.001EPSS
5.3CVSS
6.2AI Score
0.001EPSS
It was discovered that the HotSpot VM implementation in OpenJDK did not properly validate bytecode blocks in certain situations. An attacker could possibly use this to cause a denial of service. (CVE-2022-40433) Carter Kozak discovered that OpenJDK, when compiling with AVX-512 instruction support.....
5.3CVSS
5.7AI Score
0.001EPSS
openjdk-17, openjdk-21, openjdk-lts vulnerabilities
Carter Kozak discovered that OpenJDK, when compiling with AVX-512 instruction support enabled, could produce code that resulted in memory corruption in certain situations. An attacker targeting applications built in this way could possibly use this to cause a denial of service or execute arbitrary....
5.3CVSS
5.5AI Score
0.001EPSS
[SECURITY] Fedora 38 Update: openvpn-2.6.8-1.fc38
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library for...
9.8CVSS
7.3AI Score
0.005EPSS
Releases Ubuntu 23.10 Ubuntu 23.04 Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 18.04 ESM Ubuntu 16.04 ESM Packages openjdk-8 - Open Source Java implementation Details It was discovered that the HotSpot VM implementation in OpenJDK did not properly validate bytecode blocks in certain situations....
5.3CVSS
6.5AI Score
0.001EPSS
Fedora: Security Advisory for openvpn (FEDORA-2023-e4df33666c)
The remote host is missing an update for...
9.8CVSS
9.7AI Score
0.005EPSS
Releases Ubuntu 23.10 Ubuntu 23.04 Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 18.04 ESM Packages openjdk-17 - Open Source Java implementation openjdk-21 - Open Source Java implementation openjdk-lts - Open Source Java implementation Details Carter Kozak discovered that OpenJDK, when compiling...
5.3CVSS
6.3AI Score
0.001EPSS
[SECURITY] Fedora 39 Update: openvpn-2.6.8-1.fc39
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library for...
9.8CVSS
7.5AI Score
0.005EPSS