Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162PUBLISHED: 2021-01-15Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...
2020: The Year in SecurityDownload this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Tweet This
0 Comments
User Rank: Strategist
8/3/2015 | 11:34:25 AM
So what's the difference between the vault and the synchronized password? Surely only one password is more of a risk than several (even if they are all placed in a handy vault for the bad guy to get a hold of)?
First of all the level of complexity for that one password can be higher because now your user has only one password to remember.
Secondly remediation when the password is revealed or hacked is SO much easier with a synchronized password - you simply change one password to clean all systems connected to your Password Manager.
Compare that with the SSO world where users have multiple passwords they then have to change inside the SSO setup in order to restore the security of their password access.
Finally - no matter what method you choose, stale access rights are the next thing on your agenda as you try and strengthen your defences - users won't tell you what they DON'T need, nor will application owners tell you who should no longer have access.
Neccessity is the mother of invention, convenience is the father.