Without a doubt, the hottest Microsoft vulnerability in March 2020 is the "Wormable" Remote Code Execution in SMB v3 CVE-2020-0796. The most commonly used names for this vulnerability are EternalDarkness, SMBGhost and CoronaBlue. There was a strange story of how it was disclosed. It seems like Microsoft accidentally mentioned it in their blog. Than they somehow found out that the patch for this vulnerability will not be released in the March Patch Tuesday. So, they removed the reference to this vulnerability from the blogpost as quickly as they could.

Watch the video version of this episode on my YouTube channel.

Read the full text of this episode with all links on avleonov.com blog.

This will be an update to my post from 2017. In that post, I presented a small python script that parses Nessus XML reports and returns a dictionary with all the data. It worked pretty well for me until the most recent moment when I needed to get compliance data from Nessus scan reports, and it failed. So I researched how this information is stored in a file, changed my script a bit, and now I want to share it with you.

Watch the video version of this episode on my YouTube channel.

Read the full text of this episode with all links on avleonov.com blog.

I recently read Forrester's 20-page report "The Total Economic Impact™ Of Rapid7 InsightVM". It is about the Cost Savings And Business Benefits that Vulnerability Management solution can bring to the organizations. In short, I didn't like everything related to money. It seems like juggling with numbers, useless and boring. But I really liked the quotes from customers who criticized existing Vulnerability Management solutions, especially the low quality of the remediation data. These are the real pain points of Vulnerability Management process.

Watch the video version of this episode on my YouTube channel.

Read the full text of this episode with all links on avleonov.com blog.

I’ve just read a nice article about Vulnerability Management in the Acribia blog (in Russian). Here is an extract with my comments. In the most cases Vulnerability Management is not about Vulnerabilities, but about Management. Just filtering the most critical vulnerabilities is not enough.

Watch the video version of this episode on my YouTube channel.

Read the full text of this episode with all links on avleonov.com blog.