HRI
Company Details
Linkedin ID:
hard-rock-international
Website:
Employees number:
5,078
Number of followers:
139,442
NAICS:
7211
Industry Type:
Homepage:
hardrock.com
IP Addresses:
0
Company ID:
HAR_3026325
Scan Status:
In-progress
Hard Rock International Company CyberSecurity Posture
hardrock.com
Hard Rock International (HRI) is one of the most globally recognized companies with venues in over 70 countries spanning 265 locations that include owned/licensed or managed Rock Shops®, Live Performance Venues and Cafes. HRI also launched a joint venture named Hard Rock Digital in 2020, an online sportsbook, retail sportsbook and internet gaming platform. Beginning with an Eric Clapton guitar, Hard Rock owns the world’s largest and most valuable collection of authentic music memorabilia at more than 86,000 pieces, which are displayed at its locations around the globe. Hard Rock Hotels has been honored with Outstanding Guest Satisfaction and above for four consecutive years among Upper Upscale Hotels in J.D. Power’s North America Hotel Guest Satisfaction Study and in 2022, the iconic brand was ranked as the number one brand for the second year in a row. HRI is the first privately-owned gaming company designated U.S. Best Managed Company by Deloitte Private and The Wall Street Journal for the second year. Hard Rock was also honored as one of Forbes’ Best Employers for Women, Diversity and New Grads and a Top Large Employer in the Travel & Leisure, Gaming, and Entertainment Industry. In 2021, Hard Rock Hotels & Casinos received first place ranking in the Casino Gaming Executive Satisfaction Survey conducted by Bristol Associates Inc. and Spectrum Gaming Group for six of the last seven years. We are committed to fostering diversity, equity and inclusion. DE&I aims to address the needs of all team members – including Native Americans, women, LGBTQ+ community, people of color (BIPOC), people with disabilities and military veterans. Diversity: is the celebration of differences and leveraging those difference to produce stellar results. Equity: is a process of seeking fairness through deliberate and intentional actions. Inclusion: is when everyone has the freedom and comfort to express their thoughts, ideas, and opinions in a safe, trusting, and open environment.
Hard Rock International A.I CyberSecurity Scoring
HRI Risk Score (AI oriented)Between 750 and 799
HRI
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
HRI Global Score (TPRM)XXXX
HRI
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
HRI Company CyberSecurity News & History
Past Incidents
4
Attack Types
2
Hard Rock Hotel & Casino
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The California Office of the Attorney General reported a data breach involving Hard Rock Hotel & Casino on April 30, 2015. The breach may have allowed unauthorized access to credit and debit card information used at certain hotel retail and service locations between September 3, 2014, and April 2, 2015, potentially affecting customer names, card numbers, and CVV codes, but not PIN numbers. The total number of individuals affected by the breach is unknown.
Hard Rock Hotels & Casinos
Breach
Rankiteo Explanation
Attack limited on finance or reputation
Description: The California Office of the Attorney General reported a data breach involving Hard Rock International on July 7, 2017. The breach occurred on May 17, 2017, and was attributed to unauthorized access to payment card information and reservation details via Sabre Hospitality Solutions, with potential exposure of guest names, email addresses, and other visit-related information.
Hard Rock International
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Hard Rock and Loews hotel chains alerted patrons to security breaches; the issues are connected to a hack of the Sabre company's SynXis network. Payment card information for a "small subset" of clients who made bookings using the SynXis platform which was supplied by outside vendor Sabre Hospitality Solutions was obtained by thieves. After taking control of an internal account on the SynXis system, the hackers were able to access the system. The conclusion of the inquiry into the Hard Rock Hotels and Casinos franchise breach. The Federal Trade Commission and the company's consumers were informed of the event.
Hard Rock Hotel & Casino Las Vegas
Cyber Attack
Rankiteo Explanation
Attack limited on finance or reputation
Description: The Hard Rock Hotel & Casino Las Vegas suffered a **payment card breach** caused by **unauthorized access via card-scraping malware**. The incident, reported by the California Office of the Attorney General, exposed payment card data of guests who made transactions at the hotel between **October 27, 2015, and March 21, 2016**. While the exact number of affected individuals and the specific types of compromised information (e.g., card numbers, CVV, or personal details) remain undisclosed, the breach highlights a **financial and reputational risk** due to potential fraudulent transactions or misuse of payment data. The attack was executed through malware designed to **steal card details during processing**, a common tactic in cybercriminal operations targeting hospitality and retail sectors. The lack of transparency on the scale of the breach further amplifies concerns over the hotel’s data security measures and the potential long-term impact on customer trust.
HRI Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for HRI
Incidents vs Hospitality Industry Average (This Year)
No incidents recorded for Hard Rock International in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Hard Rock International in 2025.
Incident Types HRI vs Hospitality Industry Avg (This Year)
No incidents recorded for Hard Rock International in 2025.
Incident History — HRI (X = Date, Y = Severity)
HRI cyber incidents detection timeline including parent company and subsidiaries
HRI Company Subsidiaries
Hard Rock International (HRI) is one of the most globally recognized companies with venues in over 70 countries spanning 265 locations that include owned/licensed or managed Rock Shops®, Live Performance Venues and Cafes. HRI also launched a joint venture named Hard Rock Digital in 2020, an online sportsbook, retail sportsbook and internet gaming platform. Beginning with an Eric Clapton guitar, Hard Rock owns the world’s largest and most valuable collection of authentic music memorabilia at more than 86,000 pieces, which are displayed at its locations around the globe. Hard Rock Hotels has been honored with Outstanding Guest Satisfaction and above for four consecutive years among Upper Upscale Hotels in J.D. Power’s North America Hotel Guest Satisfaction Study and in 2022, the iconic brand was ranked as the number one brand for the second year in a row. HRI is the first privately-owned gaming company designated U.S. Best Managed Company by Deloitte Private and The Wall Street Journal for the second year. Hard Rock was also honored as one of Forbes’ Best Employers for Women, Diversity and New Grads and a Top Large Employer in the Travel & Leisure, Gaming, and Entertainment Industry. In 2021, Hard Rock Hotels & Casinos received first place ranking in the Casino Gaming Executive Satisfaction Survey conducted by Bristol Associates Inc. and Spectrum Gaming Group for six of the last seven years. We are committed to fostering diversity, equity and inclusion. DE&I aims to address the needs of all team members – including Native Americans, women, LGBTQ+ community, people of color (BIPOC), people with disabilities and military veterans. Diversity: is the celebration of differences and leveraging those difference to produce stellar results. Equity: is a process of seeking fairness through deliberate and intentional actions. Inclusion: is when everyone has the freedom and comfort to express their thoughts, ideas, and opinions in a safe, trusting, and open environment.
Loading...
HRI Similar Companies
TUI
We’re adventure seekers. Smile givers. Impact makers. We believe in the power of travel. It broadens horizons for our customers, and for our people too. New places to live, new roles to explore, new communities to join. It’s yours for the taking. We’re TUI, a leading global travel and leisure exp
JW Marriott
No loud pretense. No excess formalities. Just understated elegance you’ll feel the moment you walk into one of over 80 worldwide destinations. JW Marriott is part of Marriott International’s luxury portfolio and consists of beautiful properties in gateway cities and distinctive resort locations in
J D Wetherspoon
J D Wetherspoon is a leading pub operator in the UK and Ireland. Back in 1979, founder chairman Tim Martin opened the very first Wetherspoon – in Muswell Hill, north London. Today, Tim and the company run over 850 pubs and hotels, spread right across the UK and, more recently, Ireland. During its hi
Kerzner International
Kerzner International has built a diverse collection of iconic brands and luxury properties, earning international acclaim for pioneering destination-defining hospitality, delivering unrivalled service, and curating transformative guest experiences. We are renowned for creating hospitality brands
Ovations Food Services, LP
Ovations Food Services is now Spectra. Spectra is an industry leader in hosting and entertainment, partnering with clients to create memorable experiences for millions of visitors every year. Spectra’s unmatched blend of integrated services delivers incremental value for clients through several pri
Jumeirah
Jumeirah, a global leader in luxury hospitality and a member of Dubai Holding, operates an exceptional portfolio of 31 properties, including 33 signature F&B restaurants, across the Middle East, Europe, Asia and Africa. In 1999, Jumeirah changed the face of luxury hospitality with the opening of t
Shangri-La Group
Headquartered in Hong Kong SAR, the Shangri-La Group has grown from a single hotel business to a diverse and integrated global portfolio comprising quality real estate and investment properties, wellness and lifestyle facilities. Today, the Group owns, operates and manages 100+ hotels under our fami
The Country Club India Ltd
CCIL - Country Club India Ltd is one of the fastest growing entertainment and leisure conglomerate in India. A Multi-Million dollar entity and a listed company on BSE (Bombay Stock Exchange), CCIL is a pioneer in the concept of family clubbing in the country. CCIL has established 205 properties of w
Hilton (NYSE: HLT) is a leading global hospitality company with a portfolio of 24 world-class brands comprising more than 8,400 properties and over 1.25 million rooms, in 140 countries and territories. Dedicated to fulfilling its founding vision to fill the earth with the light and warmth of hospita
.png)
HRI CyberSecurity News
November 12, 2025 03:00 PM
Hard Rock International Celebrates 2025 Holiday Season With 'Hard Rock the Holidays' Light Show Spectacular at The Guitar Hotel in South Florida, Hotel Vacation Deals, Giftable Limited-Edition Merch Honoring Bruce Springsteen Fans, and More
Hard Rock International is embracing the holiday spirit with events and offerings across Hard Rock Hotels, Hard Rock Lives, Rock Shops,...
November 10, 2025 03:55 PM
Netflix (NASDAQ: NFLX) to film Mike Tyson’s Hard Rock Live show for 2026 global special
Mike Tyson will film his live show Return of the Mike at Seminole Hard Rock Hotel & Casino Hollywood on December 14, 2025 for a global...
November 10, 2025 08:00 AM
Mike Tyson's Return of the Mike Tour at Hard Rock Live® Venues to be Filmed for 2026 Netflix Special
Boxing legend's December 14 stop at Seminole Hard Rock Hotel & Casino Hollywood on highly anticipated exclusive tour to be taped for global...
November 04, 2025 08:00 AM
Beyond Meat (NASDAQ: BYND) & Hard Rock: Beyond Burger swap on beef burgers, 20g protein
Hard Rock Cafe adds the latest Beyond Burger across North America locations. 4oz patty, 20g protein, 2g sat fat, no cholesterol;...
November 01, 2025 07:00 AM
'Breathtaking fraud': BlackRock accuses Indian-origin CEO of $500m scam - All you need to know
International Business News: American investment company BlackRock reported to have fallen prey to a multi-million-dollar 'breathtaking'...
October 31, 2025 07:00 AM
Will Tua Tagovailoa play against the Baltimore Ravens tonight? Latest injury update on the popular Miami
NFL News: Despite a slow start to the season, the Miami Dolphins are set to face the Baltimore Ravens tonight. Quarterback Tua Tagovailoa...
October 26, 2025 07:00 AM
Meet all 37 White House ballroom donors funding the $300 million build
The White House has released a list of donors for the Trump administration's new ballroom construction project, following a historic East...
October 02, 2025 07:00 AM
The Stage is Set: Hard Rock Casino Tejon to open Nov. 13
TEJON, CA. – October 2, 2025 – Hard Rock International, in partnership with the Tejon Indian Tribe, today announced that Hard Rock Casino...
October 02, 2025 07:00 AM
Hard Rock Casino Tejon To Open in November
Hard Rock International, in partnership with the Tejon Indian Tribe, will open Hard Rock Casino Tejon on Nov. 13, 2025.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
HRI CyberSecurity History Information
Official Website of Hard Rock International
The official website of Hard Rock International is http://www.hardrock.com.
Hard Rock International’s AI-Generated Cybersecurity Score
According to Rankiteo, Hard Rock International’s AI-generated cybersecurity score is 751, reflecting their Fair security posture.
How many security badges does Hard Rock International’ have ?
According to Rankiteo, Hard Rock International currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Hard Rock International have SOC 2 Type 1 certification ?
According to Rankiteo, Hard Rock International is not certified under SOC 2 Type 1.
Does Hard Rock International have SOC 2 Type 2 certification ?
According to Rankiteo, Hard Rock International does not hold a SOC 2 Type 2 certification.
Does Hard Rock International comply with GDPR ?
According to Rankiteo, Hard Rock International is not listed as GDPR compliant.
Does Hard Rock International have PCI DSS certification ?
According to Rankiteo, Hard Rock International does not currently maintain PCI DSS compliance.
Does Hard Rock International comply with HIPAA ?
According to Rankiteo, Hard Rock International is not compliant with HIPAA regulations.
Does Hard Rock International have ISO 27001 certification ?
According to Rankiteo,Hard Rock International is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Hard Rock International
Hard Rock International operates primarily in the Hospitality industry.
Number of Employees at Hard Rock International
Hard Rock International employs approximately 5,078 people worldwide.
Subsidiaries Owned by Hard Rock International
Hard Rock International presently has no subsidiaries across any sectors.
Hard Rock International’s LinkedIn Followers
Hard Rock International’s official LinkedIn profile has approximately 139,442 followers.
NAICS Classification of Hard Rock International
Hard Rock International is classified under the NAICS code 7211, which corresponds to Traveler Accommodation.
Hard Rock International’s Presence on Crunchbase
No, Hard Rock International does not have a profile on Crunchbase.
Hard Rock International’s Presence on LinkedIn
Yes, Hard Rock International maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/hard-rock-international.
Cybersecurity Incidents Involving Hard Rock International
As of November 27, 2025, Rankiteo reports that Hard Rock International has experienced 4 cybersecurity incidents.
Number of Peer and Competitor Companies
Hard Rock International has an estimated 13,643 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Hard Rock International ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach and Cyber Attack.
How does Hard Rock International detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an communication strategy with informed federal trade commission and consumers, and .
Incident Details
Can you provide details on each incident ?
Title: Sabre SynXis Network Breach
Description: The Hard Rock and Loews hotel chains alerted patrons to security breaches; the issues are connected to a hack of the Sabre company's SynXis network. Payment card information for a 'small subset' of clients who made bookings using the SynXis platform which was supplied by outside vendor Sabre Hospitality Solutions was obtained by thieves. After taking control of an internal account on the SynXis system, the hackers were able to access the system. The conclusion of the inquiry into the Hard Rock Hotels and Casinos franchise breach. The Federal Trade Commission and the company's consumers were informed of the event.
Type: Data Breach
Attack Vector: Compromised Internal Account
Vulnerability Exploited: Internal Account Compromise
Motivation: Financial Gain
Title: Hard Rock Hotel & Casino Data Breach
Description: The California Office of the Attorney General reported a data breach involving Hard Rock Hotel & Casino on April 30, 2015. The breach may have allowed unauthorized access to credit and debit card information used at certain hotel retail and service locations between September 3, 2014, and April 2, 2015, potentially affecting customer names, card numbers, and CVV codes, but not PIN numbers. The total number of individuals affected by the breach is unknown.
Date Detected: 2015-04-30
Date Publicly Disclosed: 2015-04-30
Type: Data Breach
Title: Hard Rock International Data Breach
Description: The California Office of the Attorney General reported a data breach involving Hard Rock International on July 7, 2017. The breach occurred on May 17, 2017, and was attributed to unauthorized access to payment card information and reservation details via Sabre Hospitality Solutions, with potential exposure of guest names, email addresses, and other visit-related information.
Date Detected: 2017-05-17
Date Publicly Disclosed: 2017-07-07
Type: Data Breach
Attack Vector: Unauthorized Access
Title: Payment Card Incident at Hard Rock Hotel & Casino Las Vegas
Description: The California Office of the Attorney General reported that Hard Rock Hotel & Casino Las Vegas experienced a payment card incident, with the investigation identifying unauthorized access due to card scraping malware. The breach potentially affected cards used at the hotel between October 27, 2015, and March 21, 2016. The specific number of affected individuals and detailed types of information compromised are unknown.
Type: Payment Card Breach / Malware Attack
Attack Vector: Card Scraping Malware
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Internal Account Compromise.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach HAR34271123
Data Compromised: Payment Card Information
Systems Affected: SynXis Network
Payment Information Risk: True
Incident : Data Breach HAR222080425
Data Compromised: Customer names, Card numbers, Cvv codes
Payment Information Risk: True
Incident : Data Breach HAR433080425
Data Compromised: Guest names, Email addresses, Visit-related information, Payment card information, Reservation details
Payment Information Risk: True
Incident : Payment Card Breach / Malware Attack HAR258082125
Data Compromised: Payment card information
Systems Affected: Point-of-Sale (POS) Systems
Identity Theft Risk: Potential (due to payment card exposure)
Payment Information Risk: High
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Payment Card Information, Customer Names, Card Numbers, Cvv Codes, , Guest Names, Email Addresses, Visit-Related Information, Payment Card Information, Reservation Details, , Payment Card Data and .
Which entities were affected by each incident ?
Incident : Data Breach HAR34271123
Entity Name: Hard Rock Hotels and Casinos
Entity Type: Hospitality
Industry: Hotel and Casino
Customers Affected: Small subset
Incident : Data Breach HAR222080425
Entity Name: Hard Rock Hotel & Casino
Entity Type: Hospitality
Industry: Hospitality
Incident : Data Breach HAR433080425
Entity Name: Hard Rock International
Entity Type: Company
Industry: Hospitality
Incident : Payment Card Breach / Malware Attack HAR258082125
Entity Name: Hard Rock Hotel & Casino Las Vegas
Entity Type: Hospitality / Casino
Industry: Hospitality & Entertainment
Location: Las Vegas, Nevada, USA
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach HAR34271123
Communication Strategy: Informed Federal Trade Commission and consumers
Incident : Payment Card Breach / Malware Attack HAR258082125
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach HAR34271123
Type of Data Compromised: Payment Card Information
Sensitivity of Data: High
Incident : Data Breach HAR222080425
Type of Data Compromised: Customer names, Card numbers, Cvv codes
Sensitivity of Data: High
Incident : Data Breach HAR433080425
Type of Data Compromised: Guest names, Email addresses, Visit-related information, Payment card information, Reservation details
Incident : Payment Card Breach / Malware Attack HAR258082125
Type of Data Compromised: Payment card data
Sensitivity of Data: High
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach HAR34271123
Regulatory Notifications: Federal Trade Commission
Incident : Payment Card Breach / Malware Attack HAR258082125
Regulations Violated: Potential Payment Card Industry Data Security Standard (PCI DSS) violations,
Regulatory Notifications: California Office of the Attorney General
References
Where can I find more information about each incident ?
Incident : Data Breach HAR222080425
Source: California Office of the Attorney General
Date Accessed: 2015-04-30
Incident : Data Breach HAR433080425
Source: California Office of the Attorney General
Date Accessed: 2017-07-07
Incident : Payment Card Breach / Malware Attack HAR258082125
Source: California Office of the Attorney General
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Office of the Attorney GeneralDate Accessed: 2015-04-30, and Source: California Office of the Attorney GeneralDate Accessed: 2017-07-07, and Source: California Office of the Attorney General.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Data Breach HAR34271123
Investigation Status: Concluded
Incident : Payment Card Breach / Malware Attack HAR258082125
Investigation Status: Completed (as per public disclosure)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Informed Federal Trade Commission and consumers.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach HAR34271123
Customer Advisories: Informed consumers
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was Informed consumers.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Data Breach HAR34271123
Entry Point: Internal Account Compromise
Incident : Payment Card Breach / Malware Attack HAR258082125
High Value Targets: Payment Card Data,
Data Sold on Dark Web: Payment Card Data,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach HAR34271123
Root Causes: Internal Account Compromise
Incident : Payment Card Breach / Malware Attack HAR258082125
Root Causes: Card Scraping Malware Infection On Pos Systems,
Additional Questions
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2015-04-30.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2017-07-07.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Payment Card Information, customer names, card numbers, CVV codes, , Guest names, Email addresses, Visit-related information, Payment card information, Reservation details, , Payment Card Information and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident was Point-of-Sale (POS) Systems.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Email addresses, Payment Card Information, card numbers, Guest names, Reservation details, Visit-related information, CVV codes, Payment card information and customer names.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident is California Office of the Attorney General.
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Concluded.
Stakeholder and Customer Advisories
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued was an Informed consumers.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Internal Account Compromise.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Internal Account Compromise, Card scraping malware infection on POS systems.
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=hard-rock-international' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
