Overview Recently, NSFOCUS CERT found that Atlassian officially fixed a command injection vulnerability in Bitbucket Server and Data Center. Due to flaws in Bitbucket Server and Data Center, attackers with user name control rights can implement command injection through environment variables, and eventually cause commands to be executed arbitrarily on the system. The CVSS score […]

Overview On November 21, NSFOCUS CERT discovered on Internet a PoC of a remote code execution vulnerability (CVE-2022-40127) in Apache Airflow. Due to the flaw in Example Dags in Apache Airflow, an attacker with UI access rights can use this vulnerability to trigger Dags, and then by manually providing the run_id parameter, attacker can execute […]

Application programming interfaces (APIs) have become a role that can’t be ignored in digital transformation, whether in application modernization or agile business strategies. At the application development stage, APIs are standard service interfaces. When it comes to interfacing with third-party services, APIs are a common choice. In the microservice architecture, APIs are an integral part […]

NSFOCUS has been recognized as one of the Representative Vendors in the Report of Tool: Vendor Identification for Data Loss Prevention 2022 1. The COVID-19 pandemic has accelerated the process of digital transformation. With the vigorous development of digital economy and information industry, the rapid implementation and application of 5G, zero trust, AI, and blockchain […]

Gartner® recently published the report of Hype Cycle™ for Security in China, 2022. NSFOCUS has been named a Sample Vendor for situational awareness and 7 other technologies, which NSFOCUS believes validates its innovation and latest practice in security management and situational awareness. According to the report, “situational awareness (SA) technologies in China “are modern, centralized […]

Overview Recently, NSFOCUS CERT detected that Citrix released a security notice, fixing an authentication bypass vulnerability (CVE-2022-27510). When Citrix Gateway is running with Citrix ADC as a gateway device (either using the SSL VPN feature or deployed as an ICA proxy with authentication enabled), an unauthenticated remote attacker can send malicious packets to the target […]

Overview Recently, NSFOCUS CERT detected that an open source API interface management platform YApi mongo injection vulnerability was publicly released on the Internet. Due to the splicing of a certain function in YApi, MongoDB injection can be realized. Unauthenticated remote attackers can exploit this vulnerability to obtain the user token (including necessary parameters such as […]

Wednesday 2 Nov 2022 at Glowfish Together with Nextwave, NSFOCUS held the partner event Future Defense-in-Depth Security and Beyond. Apart from Anti-Distributed Denial of Service System (ADS) that NSFOCUS has experience for over 20 years, other Defense Security also have been developed to meet the needs of customers for both On-Prems, Cloud and Hybrid Security. […]

Santa Clara, Calif. November 10, 2022  – NSFOCUS, a global provider of intelligent hybrid security solutions, today announced it has received CREST’s internationally recognized accreditation for its Penetration Test services, an addition to its existing accreditation for the vulnerability assessment service.   CREST uses a rigorous quality assurance process to ensure its member companies are accredited and quality […]

During November 9th to 10th, NSFOCUS participated in Cyber Defense Initiative Conference (CDIC) in Thailand. Our experts Orajit Jamsai and Krittipol Hirunmaporn presented our hybrid Anti-DDoS solution and cloud security services during these 2 days. It was an amazing event for us to connect with Thailand’s cybersecurity community.