article thumbnail

VMware fixes critical SSRF flaw in Workspace ONE UEM Console

Security Affairs

“A malicious actor with network access to UEM can send their requests without authentication and may exploit this issue to gain access to sensitive information.” and above 2010 Workspace ONE UEM patch 20.10.0.23 and above 2010 Workspace ONE UEM patch 20.10.0.23 ” reads the analysis published by VMware.

article thumbnail

The Resurgence of Zero Trust: Why it’s Essential for CISOs and CIOs to Include in Their Strategy

CyberSecurity Insiders

History of Zero Trust Its widely accepted that the concept of zero trust was first introduced by John Kindervag, a former Forrester Research analyst, in 2010. While the idea of zero trust has been around for decades, it has gained renewed attention due to the evolving threat landscape and the increasing need for robust cybersecurity measures.

CISO 87
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Data of 2 million MyFreeCams users sold on a hacker forum

Security Affairs

CyberNews contacted MyFreeCams which confirmed the authenticity of the data and notified affected users. The investigation conducted by MyFreeCams revealed that data were stolen in “a security incident that occurred more than ten years ago in June 2010.”

article thumbnail

Most organizations have yet to fix CVE-2020-0688 Microsoft Exchange flaw

Security Affairs

Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.” A remote, authenticated attacker could exploit the CVE-2020-0688 vulnerability to execute arbitrary code with SYSTEM privileges on a server and take full control.

article thumbnail

MY TAKE: Identity ‘access’ and ‘governance’ tech converge to meet data protection challenges

The Last Watchdog

Not long afterwards, in about the 2010 time frame, IAM vendors first arrived on the scene, including Optimal IdM, Centrify, Okta and CyberArk, followed by many others. The IAM vendors took single sign-on to the next level, adding multi-factor authentication and other functionalities.

article thumbnail

100,000 WordPress sites using the Contact Form 7 Datepicker plugin are exposed to hack

Security Affairs

An authenticated stored cross-site scripting (XSS) vulnerability could allow attackers to create rogue admins on WordPress sites using Contact Form 7 Datepicker plugin. 2020 – An authentication bypass vulnerability in the InfiniteWP plugin that could potentially impact by more than 300,000 sites.

Hacking 98
article thumbnail

Nation-state actors target critical sectors by exploiting the CVE-2021-40539 flaw

Security Affairs

.” Experts also detailed the KdcSponge credential stealer, which hooks into the Windows LSASS API from within the LSASS process to steal credentials from inbound attempts to authenticate via the Kerberos service (“KDC Service”). The APT group has been active since 2010, targeted organizations worldwide, including U.S.