Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Vulnerability

ISO/IEC 27001 compliance guide for CISOs and IT Managers

Building trust with customers often starts by demonstrating the right security controls. In the digital age, data security is paramount, and adherence to standards like ISO/IEC 27001, PCI DSS, and SOC 2 has become a key differentiator in the competitive market landscape.

Snyk recognized as an Emerging Segment Leader in Application Security in Snowflake's Next Generation of Cybersecurity Applications report

We are thrilled to announce that Snyk has been acknowledged as a key player in the evolving landscape of application security. The recent release of Snowflake's Next Generation of Cybersecurity Applications report has designated Snyk as an Emerging Segment Leader in Application Security, highlighting our commitment to innovation and excellence in the field.

CVE-2023-36553: Critical OS Command Injection Vulnerability in FortiSIEM

On November 14, 2023, FortiGuard published an advisory disclosing that a critical command injection vulnerability (CVE-2023-36553) had been patched in the latest updates for FortiSIEM. The vulnerability was rated with a Common Vulnerability Scoring System (CVSS) score of 9.3, as it can be exploited remotely by an unauthenticated threat actor using crafted API requests to execute unauthorized commands. This vulnerability is caused by improper neutralization of special elements in FortiSIEM report server.

Weekly Cybersecurity Recap December 8

This week’s data breaches contained significant impact figures from around the world. Malware on a vendor’s computer inadvertently breached Japan’s Line Messenger. New York’s East River Medical Imaging suffered the loss of employee and patient record information. The Pan-American Life Insurance Group faces a 105k record data breach through MOVEit.

Demystifying CVSS Scoring

The Common Vulnerability Scoring System (CVSS) can help you navigate the constantly growing ocean of open source vulnerabilities. But it’s difficult to lend your trust and put the security of your organization and your customers into the hands of a system that you may know very little about. Let’s take a closer look at the CVSS to see what it’s all about.

CrowdStrike Discovers Vulnerability in Flexera's FlexNet Inventory Agent (CVE-2023-29082)

CrowdStrike’s cloud security team discovered a new vulnerability (CVE-2023-29082) in Flexera’s FlexNet Inventory Agent. When exploited, an attacker can escape from a container and gain root access to the host. Exploitation of CVE-2023-29082 can allow an attacker to perform a variety of actions on objectives, including execution of malware and exfiltration of data.

SEC Allegations: SolarWinds CISO Aware of Cyber Risks Who Should Fix Vulnerabilities? #podcast

Welcome to our latest video where we unpack the recent SEC allegations surrounding SolarWinds CISO's awareness of cybersecurity risks and vulnerabilities. The SEC claims that despite this awareness, the issues were not adequately addressed. Join us as we delve into the critical question: Is the CISO now responsible for fixing vulnerabilities?

How Malicious Insiders Use Known Vulnerabilities Against Their Organizations

We are well aware of the devastating effect insiders can have when using their legitimate access and knowledge to target their own organization. These incidents can result in significant monetary and reputational damages. Entities small and large, across all sectors, can fall victim to insider threats.

Atlassian Releases Four Critical Patches to Prevent RCE

Atlassian has released software fixes to address four critical flaws in its software that, if successfully exploited, could result in remote code execution. In late October 2023, Atlassian issued a warning about a critical security flaw, CVE-2023-22518 (CVSS score 9.1), impacting all versions of Confluence Data Center and Server. This improper authorization issue poses a significant risk of data loss if exploited by an unauthenticated attacker.