Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-2509PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later Q...
CVE-2020-36195PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
CVE-2021-29445PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
CVE-2021-29446PUBLISHED: 2021-04-16
jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
CVE-2021-29451PUBLISHED: 2021-04-16Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.
0 Comments
Tweet This
User Rank: Ninja
2/15/2016 | 7:40:27 AM
what is the full cost of hacking today ?
not just the loss of cash and merchandise: there is also the loss of labor employed in attempting ineffective defenses. defenses which can never be effective because they fail to address the root of the problem: insecure operating software and compromised symmetric identifications
a secure operating system will not allow itself to be compromised by the activity of an application program . that is the starting point as it is critical to portecting the security software needed for authenticating and protecting documents and transactions .
it is probably necessary to design and deploy a KEK -- key encryption key device
the KEK would carry a copy of GnuPG or PGP plus the related keyrings. it must be a single purpose device so that updates can be stictly controlled -- not like a "smart" phone .
the KEK is an identification carrier and as such would need to be maintained by facilities that are currently responsible for validating identifications: Credit Unions, DMV, County Clerk, Notaries and such .
the KEK could then be used to authenticate and protect form 1040.
symmetric ID such as traditional name, address, DoB, SSN, phone number, mother's maiden name, e/mail are known as "PII" -- and are hopelessly compromised.