How NodeZero Enhances Cybersecurity

Amidst the hustle and bustle of holiday preparations and last-minute shopping, cybercriminals often take advantage of the increased online activity and spending complacency of individuals and businesses…

Stephen Gates, Principal Security SME at Horizon3.ai and Calvin Engen, Chief Technology Officer, and Managing Partner of F12.net discuss:

– Why there is a such growing demand for managed cybersecurity services.
– What’s helping F12 clients meet and exceed cybersecurity standards and best practices.
– Where Calvin thinks the security industry is headed and what technologies stand out.
– How F12 is currently using the Horizon3.ai NodeZero platform in their service offerings.

Low-Level Vulnerability Leads to Domain Compromise

CVE-2024-23897: Assessing the Impact of the Jenkins Arbitrary File Leak Vulnerability.

On January 22, 2024 Fortra posted a security advisory for their GoAnywhere MFT product. This advisory details an authentication bypass vulnerability, CVE-2024-0204, that allows an unauthenticated attacker to create an administrative user for the application. Customers...

Introduction Back in Aug. 2023 we released an advisory for CVE-2023-39143, a critical vulnerability that affects Windows installs of the PaperCut NG/MF print management software. Attackers can exploit this vulnerability to download and delete arbitrary files, and in...

Businesswire: 10/20/22 NodeZero was named a winner for its ability to continuously assess an enterprise's internal and external attack surface, and how it reveals the many ways in which an attacker could leverage harvested credentials, misconfigurations, dangerous...

Businesswire: 10/13/22 The SDC Awards recognize and reward products and services that are the foundation for digital transformation. NodeZero has been named a ‘Cloud Security Innovation of the Year’ finalist. NodeZero was selected for its impact on the market and...

Businesswire: 09/27/22 Horizon3.ai announced it has expanded its partner program to include new rewards, incentives, training, and tools to help partners drive more recurring revenue. The mission of the Horizon3.ai Partner Program is to drive growth opportunities for...

Stephen Gates, Principal Security SME at Horizon3.ai and Calvin Engen, Chief Technology Officer, and Managing Partner of F12.net discuss:

Low-Level Vulnerability Leads to Domain Compromise

CVE-2024-23897: Assessing the Impact of the Jenkins Arbitrary File Leak Vulnerability.

Apache Superset is a popular open source data exploration and visualization tool. In a previous post, we disclosed a vulnerability, CVE-2023-27524, affecting thousands of Superset servers on the Internet, that enables unauthorized attackers to gain admin access to these servers. We also alluded to methods that an attacker, logged in as an admin, could use to harvest credentials and execute...

Introduction Ivanti has recently published an advisory for CVE-2023-38035. The vulnerability has been added to CISA KEV and is described as an authentication bypass in the Ivanti Sentry administrator interface. This new vulnerability comes on the heels of an in-the-wild-exploited vulnerability in Ivanti EPMM (CVE-2023-35078). In this post we will take a deep dive into how this new vulnerability can...

Horizon3.ai CEO Snehal Antani discuss several real-world examples of what autonomous pentesting discovered in networks just like yours. You’ll hear more about how fast and easy it was to safely compromise some of the biggest (and smallest) networks in the world - with full domain takeover in a little more than a few hours. Learn how you can safely do...

Introduction In December 2022, we competed at our first pwn2own. We were able to successfully exploit the Lexmark MC3224i using a command injection 0-day. This post will detail the process we used to discover, weaponize, and have some fun with this vulnerability. You can find our POC here. Printer Acquisition It was rather difficult to acquire the Lexmark MC3224adwe. So...

Last Watchdog Editor-In-Chief Byron Acohido interviews Horizon3.ai CEO Snehal Antani about advanced pentesting tools and services.

Summary CVE-2023-39143 is a critical vulnerability we disclosed to PaperCut that affects the widely used PaperCut NG/MF print management software. It affects PaperCut NG/MF running on Windows, prior to version 22.1.3. If you are a user of PaperCut on Windows, and have it exposed to the Internet, we recommend you check out the July 2023 PaperCut security bulletin and immediately...

Security Strategies

Industry Insights

Attack Research

No Results Found

Attack Content

Security Strategies

Industry Insights

Attack Research

No Results Found

Attack Content

Research Blog

Filters