Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3663PUBLISHED: 2021-07-25firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
CVE-2021-23413PUBLISHED: 2021-07-25This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.
CVE-2021-37436PUBLISHED: 2021-07-24
Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly, there were vendor marketing statements about safely removing pers...
CVE-2021-32686PUBLISHED: 2021-07-23
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and ...
CVE-2021-32783PUBLISHED: 2021-07-23
Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy rem...
The State of Cybersecurity Incident ResponseIn this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Tweet This
0 Comments
User Rank: Guru
8/8/2013 | 7:07:35 PM
The NIST Workshops on the Cyber Security Framework are revealing an underlying reluctance to harmonize standards associated with resistance to regulation. Here there are trust issues associated with the commitment to voluntary compliance. Beyond that Congress is split on what kind and whether incentives should be offered especially on indemnification of liability.
And then there is the issue of moral hazard faced by industry participants. If they know of threats and risks and don't act on behalf of their customers and the public, there are consequences.