The FLIR Brickstream 3D+ sensor is vulnerable to unauthenticated config download and file disclosure vulnerability when calling the ExportConfig REST API (getConfigExportFile.cgi). This will enable the attacker to disclose sensitive information and help her in authentication bypass, privilege escalation and/or full system access.

Synaccess netBooter NP-02x and NP-08x version 6.8 suffer from an authentication bypass vulnerability due to a missing control check when calling the webNewAcct.cgi script while creating users. This allows an unauthenticated attacker to create an admin user account and bypass authentication giving her the power to turn off a power supply to a resource.

The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. In the IDAL CGI interface, there is a URL (/cgi/loginDefaultUser), which will create a session in an authenticated state and return the session ID along with the username and plaintext password of the user. An attacker can then login with the provided credentials or supply the string 'IDALToken=......' in a cookie which will allow them to perform privileged operations such as restarting the service with /cgi/restart.

D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi (function genacgi_main() in /htdocs/cgibin), which is accessible without credentials.

Atlantis in South Africa has a new SEZ focused on green manufacturing, which is hoping to turn around the area's fortunes. Annie Hessler reports.

Htcap is a web application analysis tool for detecting communications between javascript and the server. It crawls the target application and maps ajax calls, dynamically inserted scripts, websockets calls, dynamically loaded resources and some interesting elements. The generated report is meant to be a good starting point for a manual web application security audit. Htcap is written in python and uses phantomjs to load pages injecting a probe that analyzes javascript behaviour. Once injected, the probe, overrides native javascript methods in order to intercept communications and DOM changes. It also simulates user interaction by firing all attached events and by filling html inputs.

Here is the short answer to the question of how many Microsoft products you can request: You can get 50 of each kind of product in a two-year period — but there are some exceptions.

See Microsoft products

What do you mean by "each kind of product"?

The Microsoft Donation Program divides products into categories called title groups. See the current list of 37. A title group contains products that serve essentially the same purpose, like PowerPoint and PowerPoint for Mac.

You can get products from 10 title groups in your two-year cycle.

When does this two-year cycle start and end? Is it the calendar year?

No. Your nonprofit has its own two-year cycle. Your first cycle started the day you requested your first Microsoft product through TechSoup. You can see when your current cycle ends on your Microsoft Donation Center page.

Outlook and PowerPoint are both title groups. Does that mean we can get 50 of each product?

That's right. They can be all the Windows version, all the Mac version, or a mixture of the two. And you will be able to request products from eight more title groups.

What are the exceptions you mentioned?

They have to do with servers. Microsoft offers two licensing models for its server products.

• Core-based licensing. This licensing is based on the number of cores in the physical processors of your server machines. The product page on TechSoup will tell you whether the server uses this type of licensing. You can request up to 50 of these products from each title group, the same as desktop products. But you might have to request more than one product to fully license all the processors in your server.
• Non-core-based licensing. You can request a total of five server products that do not use core-based licensing. They can be from a single title group or from different title groups, but the total cannot be more than five.

A lot of the title groups are for CALs and MLs. What are the limits for these?

You can get 50 from each title group.

CALs, or client access licenses, give you access to a server from a device like your desktop computer.

MLs, or management licenses, let your device be managed by a management server.

Where can I find out more?

This article goes into a lot more detail and gives examples of how the various allotments work together.

spanhidden

In this age of increasing hacks and cybercrime, the Norman Rockwell Museum has a lot of digital assets, museum operations data, and private patron data that need to be protected. Find out why Frank Kennedy, IT manager at the Rockwell museum, chose Veritas Backup Exec to be a key part of the museum's security strategy.

About the Museum

Norman Rockwell is one of the great iconic painters and illustrators of American life in the 20th century. His hundreds of covers for the Saturday Evening Post magazine alone are a national treasure. The Norman Rockwell Museum is located in Stockbridge, Massachusetts, where Rockwell spent the last part of his celebrated life. The museum started two years before Rockwell's death in 1978 and houses over 100,000 of his works and also those of other illustrators.

The museum now has 140,000 annual visitors, and 220,000 people view its traveling exhibitions each year. It also has an active website with more than 600,000 worldwide unique visitors per year.

The Museum's IT System

IT Manager Frank Kennedy is an IT department of one (plus an occasional contractor). He supports 90 staff and volunteers and is responsible for critical information security and data protection for the museum.

The museum's IT network consists of several large physical servers and many single-purpose virtual machines. The single-purpose virtual machines allow for emergency service without disrupting other departments.

Frank says, "Most of our enterprise software is procured via TechSoup, which makes it affordable to license so many servers! We do not have to make do with weak, low-budget software."

Digital Assets: Preserving Art over the Long Term

Frank Kennedy explains that digital assets are of increasing importance in the work of museums. There are high-resolution images or copies of art works that must be carefully stored to preserve work in its best condition. He says that digital versions are often irreplaceable, as when the original object is disintegrating or would be damaged by further handling.

The digital versions keep a faithful record of the art in its best state. The most sensitive objects of this museum include a collection of Rockwell's cellulose nitrate film negatives, which deteriorate over time.

The museum also has analog audio and video tape and motion picture film that deteriorates, as well as works on paper that degrade with exposure to light. Other crucial data for the museum includes databases for collection management, point of sale records, donor management, and email.

Frank's backup system is designed to be redundant on purpose. He says, "Protecting this data means keeping many copies in many places. Doing so becomes a big challenge when the size of the data becomes several terabytes. I use many layers of redundancy."

The Backup Crisis

As the museum's data got bigger and bigger, and server patches piled on, the museum's previous backup solution eventually became unstable. Frank reports that his backups were failing constantly and causing him stress in his careful, risk-based management approach. When he first went to get a new backup solution from TechSoup, he discovered that what he needed was not available.

He says, "The cost for the options I use would have been over $4,000 per year, unbudgeted. TechSoup responded to users' desperate cry and worked with Veritas to bring Backup Exec back to TechSoup! I can't even describe my relief. Veritas Backup Exec is better than ever. It is so stable that I get suspicious and have to go look just to be sure it's really working!"

Why the Norman Rockwell Museum Chose Backup Exec over Other Options

Frank told me that the license he gets from TechSoup includes every option his museum needs. These options and features include

• Exchange Server backup
• Unlimited media server backups
• Unlimited agents for specific applications like VMware, Windows, Linux, and so on
• Simplified disaster recovery
• Protection against accidental deletion, damage, or overwriting
• Storing backups to disk, network share, tape (any type), or cloud — or all four at once
• Virtual machine snapshots that are viewable directly from the host's agent
• A deduplication engine so backed-up data is as clean as possible
• Backup retention periods that can be defined per job and per media server
• An excellent graphical user interface
• The status of every backed-up resource available at a glance
• Sending an email to the admin when anything goes wrong
• Running several jobs simultaneously (depending on server horsepower)

Advice for Museums and Other Organizations Considering Veritas Backup Exec

• Backup Exec is powerful software geared toward backing up an entire network. It requires some study to do the installation and learn the software.
• You don't get phone support with the charity licensing, so you need to be comfortable Googling for answers and working in the Veritas community support forum.
• Frank recommends dedicating a strong server for running the software. He likes eight cores and 32 GB of RAM; hot-swappable, hot-growable RAID-5; fast network connectivity; and a very large uninterruptible power supply (UPS).
• Avoid the temptation to install other services or applications on what seems to be a machine that is often idle.

In a Nutshell

Frank's experience is that "Veritas Backup Exec is the best, most reliable, most flexible, and versatile backup software you can get. Commit the needed resources to operate it, and you will be rewarded with peace of mind and business continuity. Your donors will be pleased that you are protecting their investment so carefully."

Image: Norman Rockwell Museum / All rights reserved / Used with permission

spanhidden

Twenty-five countries attracted high-ticket investment deals at the Africa Investment Forum

The EU is considering a broader mandate for the EBRD, and its president, Sir Suma Chakrabarti, believes its model would work in sub-Saharan Africa.

Poor infrastructure and political instability deter tourism, but small and manageable steps to avoid chaos and promote hospitality can work wonders.

Sub-Saharan Africa is the world’s fastest growing mobile phone market, but how can telecoms companies make the most of the huge opportunities the region provides?

The UN Sustainable Development Goals aim to end global poverty, but poorer countries are struggling to hit them. More help from richer countries is crucial, writes Mazdak Rafaty.

Combining a strategic location with an investor-friendly environment, Egypt is ensuring its Suez Canal Economic Zone is primed for foreign investment. 

FDI levels have already fallen throughout Iran's main sphere of influence in the region. 

Lower fertility rates will boost economic growth, according to a demographic model developed by Renaissance Capital. 

India’s 2020 budget continues the process of opening up to overseas investment.

Announced greenfield projects into China plummeted in early 2020 with the US and Europe taking the lion's share of global foreign investment. 

London event hears how the UK export credit agency is increasing its focus on trade with African countries. Jason Mitchell reports.

WhatWeb is a next-generation web scanner. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. WhatWeb supports an aggression level to control the trade off between speed and reliability.

WhatWeb is a next-generation web scanner. WhatWeb recognizes web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1800 plugins, each to recognize something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more. WhatWeb supports an aggression level to control the trade off between speed and reliability.

Kuwait's National Vision 2035 has economic diversification at its heart. This move from hydrocarbon reliance to other sectors is attracting investor attention, as Wendy Atkins reports.

Long-dominant global supply chains look less tenable in the light of pressures ranging from pandemics to disasters, trade tensions and protectionism.

The UK is the top country, but Dublin is leading city, for foreign companies setting up headquarters in Europe, according to fDi’s ranking.

The global pharmaceutical sector has seen consistent growth since 2014, with western Europe a major beneficiary.

Eco Equity is one of only a few Europe-based investors in medicinal cannabis from Africa and the Caribbean, an area in which the UK is missing an opportunity, according to CEO Jon-Paul Doran.

The UAE followed Singapore’s swift reaction to combat Covid-19, to preserve the health of its citizens. Now moves are in place to tackle the country’s economic wellbeing.

The coronavirus pandemic could change human behaviour more permanently in future.

The fallout from the pandemic looks set to stall trade and investment to Latin America.

Having opened new production facilities in Rwanda and South Africa, Mara Phones is looking to alter Africa's mindset from being a 'consumer' to being a 'manufacturer'. 

Continued African development could hinge on public finance reforms.

Passion Capital's Eileen Burbidge talks to fDi about what fintech companies should consider when expanding internationally, and why London will always be a key market in the sector.

Financial incentives from two different cities persuaded US grocery chain The Fresh Market to stay headquartered in its home state of North Carolina.

AstraZeneca will set up a R&D centre and an AI innovation centre in Shanghai, as well as create a $1bn fund that would invest in healthcare start-ups.