Tenable ブログ
Tenable Hexa AI: エクスポージャー管理のための自律型 AI が登場
CVE-2020-14882: Oracle WebLogic のリモートコード実行脆弱性を利用した攻撃が確認される
A remote code execution vulnerability in Oracle WebLogic Server has been actively exploited in the wild just one week after a patch was released and one day after a proof of concept was published.Update October 30, 2020: The solutions section has been updated to reflect the disclosure of a…
AWS Identity Federation and Least Privilege – Friends or Foes?
Learn how to address the challenges in basic and advanced implementations of AWS federation.
CodeMeter に発見された複数の脆弱性が産業制御システムを攻撃にさらしている
Six vulnerabilities in a popular license management product put industrial control systems at risk for remote attacks. Background On September 8, researchers at Claroty published their detailed analysis, dubbed “License to Kill,” covering several vulnerabilities they discovered in CodeMeter…
オリジン間リソース共有における脆弱性
To avoid exposure to a variety of web application vulnerabilities, specific security considerations must be made when implementing Cross-Origin Resource SharingToday’s modern web applications rely heavily on JavaScript to be dynamic, and ensure the best experience for end-users. Providing content…
Protect Applications and Data with Cloud Infrastructure Entitlements Management (CIEM)
Breaking down the hype around cloud infrastructure entitlements management.
新型コロナウイルス感染症（COVID-19）に便乗した Venmo、PayPal、Cash AppCVE を利用するプレゼント詐欺
The economic impact of COVID-19, which is causing record unemployment, creates a golden opportunity for scammers looking to target vulnerable people desperate for cash to help pay their bills.As Cash App steps up the frequency of its giveaways, and celebrities and other notable figures launch…
「VPR」とは何か。「CVSS」とはどう違うのか。
このブログシリーズでは、さまざまな観点からVPR（脆弱性の優先度評価）について詳しく説明します。Part one will focus on the distinguishing characteristics of VPR that make it a more suitable tool for prioritizing remediation efforts than the Common Vulnerability…
CVE-2020-1938: Ghostcat - Apache Tomcat AJP における実行ファイル読み込み・インクルージョンに関する脆弱性 (CNVD-2020-10487)
Several proof-of-concept exploit scripts for recently patched flaw in Apache Tomcat are now available.BackgroundOn February 20, China National Vulnerability Database (CNVD) published a security advisory for CNVD-2020-10487, a severe vulnerability in Apache Tomcat’s Apache JServ Protocol (or AJP)…
Tenable Lumin でプロセスの整合性におけるリスクを把握
成熟したリスクベースの脆弱性管理を実践するには、ビジネスシステムのリスクとプロセスの整合性のリスクを評価する 2 つのリスク指標が不可欠です。Tenable Lumin の新しい評価成熟度スコアは、両方に対する知見を提供します。Risk-based vulnerability management requires metrics addressing two types of…
