Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Vulnerability

Introducing Snyk AppRisk Essentials

Snyk AppRisk Essentials is Snyk’s first ASPM offering, designed to help AppSec teams boost their Snyk-based developer security program. The solution helps Snyk customers automatically discover the different assets used to build their applications, manage coverage to ensure these assets are being secured properly by Snyk, and better prioritize issues based on the risk they pose to the business.

ISO/IEC 27001 compliance guide for CISOs and IT Managers

Building trust with customers often starts by demonstrating the right security controls. In the digital age, data security is paramount, and adherence to standards like ISO/IEC 27001, PCI DSS, and SOC 2 has become a key differentiator in the competitive market landscape.

Snyk recognized as an Emerging Segment Leader in Application Security in Snowflake's Next Generation of Cybersecurity Applications report

We are thrilled to announce that Snyk has been acknowledged as a key player in the evolving landscape of application security. The recent release of Snowflake's Next Generation of Cybersecurity Applications report has designated Snyk as an Emerging Segment Leader in Application Security, highlighting our commitment to innovation and excellence in the field.

CVE-2023-36553: Critical OS Command Injection Vulnerability in FortiSIEM

On November 14, 2023, FortiGuard published an advisory disclosing that a critical command injection vulnerability (CVE-2023-36553) had been patched in the latest updates for FortiSIEM. The vulnerability was rated with a Common Vulnerability Scoring System (CVSS) score of 9.3, as it can be exploited remotely by an unauthenticated threat actor using crafted API requests to execute unauthorized commands. This vulnerability is caused by improper neutralization of special elements in FortiSIEM report server.

Weekly Cybersecurity Recap December 8

This week’s data breaches contained significant impact figures from around the world. Malware on a vendor’s computer inadvertently breached Japan’s Line Messenger. New York’s East River Medical Imaging suffered the loss of employee and patient record information. The Pan-American Life Insurance Group faces a 105k record data breach through MOVEit.

Demystifying CVSS Scoring

The Common Vulnerability Scoring System (CVSS) can help you navigate the constantly growing ocean of open source vulnerabilities. But it’s difficult to lend your trust and put the security of your organization and your customers into the hands of a system that you may know very little about. Let’s take a closer look at the CVSS to see what it’s all about.

CrowdStrike Discovers Vulnerability in Flexera's FlexNet Inventory Agent (CVE-2023-29082)

CrowdStrike’s cloud security team discovered a new vulnerability (CVE-2023-29082) in Flexera’s FlexNet Inventory Agent. When exploited, an attacker can escape from a container and gain root access to the host. Exploitation of CVE-2023-29082 can allow an attacker to perform a variety of actions on objectives, including execution of malware and exfiltration of data.

SEC Allegations: SolarWinds CISO Aware of Cyber Risks Who Should Fix Vulnerabilities? #podcast

Welcome to our latest video where we unpack the recent SEC allegations surrounding SolarWinds CISO's awareness of cybersecurity risks and vulnerabilities. The SEC claims that despite this awareness, the issues were not adequately addressed. Join us as we delve into the critical question: Is the CISO now responsible for fixing vulnerabilities?

How Malicious Insiders Use Known Vulnerabilities Against Their Organizations

We are well aware of the devastating effect insiders can have when using their legitimate access and knowledge to target their own organization. These incidents can result in significant monetary and reputational damages. Entities small and large, across all sectors, can fall victim to insider threats.