Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28452PUBLISHED: 2021-01-20
This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request ...
CVE-2020-28483PUBLISHED: 2021-01-20This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
CVE-2021-21269PUBLISHED: 2021-01-20
Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust `join` method without checking user input might have made it abe to do a Path Traversal attack causing to read more f...
CVE-2020-25686PUBLISHED: 2021-01-20
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same...
CVE-2020-25687PUBLISHED: 2021-01-20
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This...
Latest Comment: This is not what I meant by "I would like to share some desk space"
2020: The Year in SecurityDownload this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Tweet This
0 Comments
User Rank: Apprentice
8/22/2018 | 12:57:36 PM
It comes under configuration management.
Security needs to be abstracted away from business requirements.
Its a given in IoT.
Example used here already people 2016
https://www.wolfssl.com/wolfmqtt-v0-3-and-mqtt-secure-firmware-update-example/
https://www.wolfssl.com/docs/atmel/
My own IoT design's are designed to show the IT world how to do SECURITY.
In hardware. Like U2F from FIDO/FIDO2 for humans.
508a/608a or SAML11 for your edge nodes.
SAML11 for youre secure IoT hub talking MQTT over HTTPS.
It does not matter if your IP security fails.
The data is protected by hardware security.
Your heart beat system will tell you of DOS on your IP part.
ONLY PUBLIC KEYS are in the wild in secure IoT systems.