The Metasploit crew at Rapid7 is headed out to Las Vegas for DEF CON 27, bringing a new incarnation of the Open Source Security Meetup (OSSM) with us! We will have a Metasploit Suite at Bally’s this year, where we’ll be hosting “Open…
We hope our American friends had a wonderful Fourth of July weekend! There are no new modules this week, so instead we're featuring two enhancements that fix some long outstanding Framework bugs. Check out last week’s holiday wrap-up for a list of the modules…
In this blog, we are going to explore the basics of how to make queries in our cloud-based vulnerability management solution, InsightVM.…
Here's what you need to know about the recent Zoom vulnerability disclosure.…
Patch Tuesday for July 2019 is on the heavier side as far as they go, with Microsoft fixing 77 vulnerabilities in total. Microsoft also published an advisory describing a cross-site scripting vulnerability in the on-premise edition of Outlook for web (previously known as Outlook Web…
In this blog, we will talk about threat detection for the world’s most popular cloud host, Amazon Web Services (AWS).…
We are excited to release two new features to improve the flexibility of our container assessment capabilities: our new Container Registry Sync App and Container Image Scanner for InsightVM.…
Injecting the Time Machine From contributor timwr comes a new module targeting Time Machine on macOS 10.14.3 and earlier. Specifically, the tmdiagnose binary for these vulnerable versions suffers from a command injection vulnerability that can be exploited via a specially crafted disk label.…
I am Root An exploit module for Nagios XI v5.5.6 was added by community contributor yaumn. This module includes two exploits chained together to achieve code execution with root privileges, and it all happens without authentication. A single unsanitized parameter in magpie_debug.…
This post reviews logging considerations for Microsoft Azure environments, and integrations and detections available in Rapid7’s cloud SIEM, InsightIDR.…
In our brand-new podcast, Security Nation, Zate Berg of Indeed.com explains how he avoided making his team an engineering bottleneck through automated appsec.…
