Security News
Attackers are actively exploiting a critical, pre-authorization remote-code execution vulnerability in the popular Access Management platform from digital identity management firm ForgeRock. On Monday morning, the Cybersecurity and Infrastructure Security Agency warned that the vulnerability could enable attackers to execute commands in the context of the current user.
SolarWinds is urging customers to patch a Serv-U remote code execution vulnerability exploited in the wild by "a single threat actor" in attacks targeting a limited number of customers. "Microsoft has provided evidence of limited, targeted customer impact, though SolarWinds does not currently have an estimate of how many customers may be directly affected by the vulnerability," the company said in an advisory published on Friday.
Infovista launched its next generation Ipanema SD-WAN platform, designed to deliver different workloads and applications across conventional Wide Area Networks and multiple cloud service providers. The Ipanema SD-WAN platform delivers the truly software-defined benefits of allowing critical applications to dynamically adapt to the real-time conditions of the network while prioritizing the prevailing business imperatives.
Multiple security vulnerabilities have been disclosed in Philips Clinical Collaboration Platform Portal, some of which could be exploited by an adversary to take control of an affected system. "Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or affect system data integrity in such a way as to negatively impact the confidentiality, integrity, or availability of the system," the U.S. Cybersecurity and Infrastructure Security Agency noted in an advisory.
Four security vulnerabilities have been uncovered in the Sage X3 enterprise resource planning product, two of which could be chained together as part of an attack sequence to enable adversaries to execute malicious commands and take control of vulnerable systems. The vendor has since rolled out fixes in recent releases for Sage X3 Version 9, Sage X3 HR & Payroll Version 9, Sage X3 Version 11, and Sage X3 Version 12 that were shipped in March.
Admins of on-premises Sage X3 ERP deployments should check they're not exposing the enterprise resource planning suite to the public internet in case they fall victim to an unauthenticated command execution vulnerability. The infosec outfit described in detail the flaws, calling them "Protocol-related issues involving remote administration of Sage X3.".
Everbridge announced a partnership with Tech Data, an IT distribution and solutions aggregator serving more than 125,000 partners, globally. The partnership helps enterprises and other organizations automate the response to, and build resilience against, critical events, from cyber-attacks and IT outages to severe weather events and more, while opening new routes to market for Everbridge.
Four vulnerabilities afflict the popular Sage X3 enterprise resource planning platform, researchers found - including one critical bug that rates 10 out of 10 on the CVSS vulnerability-severity scale. The critical bug allows unauthenticated remote command execution with elevated privileges in the AdxDSrv.
Administrators are urged to apply the latest patches from Microsoft and disable the Windows Print spooler service in domain controllers and systems not used for printing. Microsoft is grappling with a couple of security holes in its Windows Print spooler service that could allow attackers to remotely control an affected system.
Fixing a serious security hole in the Windows Print spooler service, the patch is available for almost all versions of Windows, even Windows 7. Microsoft has deployed a patch for a vulnerability so critical that even older, unsupported versions of Windows are receiving it.