Synology DiskStation Manager OS Command Injection (CVE-2018-13284)

Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mo...

Synology DiskStation Manager SQL Injection (CVE-2021-43927)

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Security Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. This plugin only works with...

Synology DiskStation Manager NTPD Denial of Service (CVE-2018-7185)

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service disruption by continually sending a packet with a zero-origin timestamp and source IP address of the other side of an interleaved association causing the victim ntpd to reset its association...

Synology DiskStation Manager Out-of-bounds Read (CVE-2022-3576)

A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band OOB Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager DSM versions before 7.1.1-42962...

Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2020-27656)

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man- in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Weak Password Recovery Mechanism for Forgotten Password (CVE-2018-8916)

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Proactive Visibility Is Foundational to Strong Cybersecurity

Authored by Guest IDC Blogger: Michelle Abraham Exposures are more than CVEs, so organizations need to move beyond the traditional thinking of vulnerability management to a holistic view. Part of that view must be greater visibility into devices, users, applications, and all the digital...

Qualys Ranked as a “Strong Performer” Among Top Vendors in Forrester Wave™ for Attack Surface Management

As the threat landscape evolves and presents new risks to security teams, the bar for attack surface management solutions is higher than ever. When Qualys introduced CyberSecurity Asset Management in 2021, the goal was to provide a unified view of the entire attack surface with visibility into...

Digital Asset Trading Platform UEEx Strengthens Digital Asset Security with New Protection Policy

UEEx enhances user security with new compensation policies addressing abnormal market volatility and asset protection. Users can now…...

Three Recommendations for Creating a Risk-Based Detection and Response Program

It should come as little surprise to most security professionals that keeping pace with the evolution of threat actors has become harder and harder. Maintaining visibility into the threat landscape and on top of external risk vectors is more than a matter of incorporating more point solutions. It...

WoodWing Elvis DAM 安全漏洞

WoodWing Elvis DAM is a digital asset management solution from WoodWing, Inc. A security vulnerability exists in WoodWing Elvis DAM version 6.98.1, which stems from a Remote Command Execution RCE vulnerability that includes authentication via the Apache Ant scripting feature...

The vulnerability of the updateAssetInfo method in the Ivanti EPM endpoint management software allows a hacker to execute arbitrary code.

The vulnerability of the updateAssetInfo method in the Ivanti EPM endpoint management software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Security Bulletin:IBM Asset Data Dictionary Component uses aircompressor-0.21.jar which is vulnerable to CVE-2024-36114

Summary IBM Asset Data Dictionary Component uses aircompressor-0.21.jar which is vulnerable to CVE-2024-36114. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-36114 DESCRIPTION: airlift aircompressor could allow a local attacker...

Security Bulletin: Multiple Vulnerabilities in Rational Asset Manager

Summary Multiple vulnerabilities were addressed in Rational Asset Manager version 7.5.4.15 Vulnerability Details CVEID:CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to apply a configured connection during the initial handshake of an HTTPS...

JVN#42386607: Assimp vulnerable to heap-based buffer overflow

PlyLoader.cpp of Assimp provided by Open Asset Import Library contains a heap-based buffer overflow vulnerability CWE-122. Impact An attacker may execute arbitrary code by importing a specially crafted file into the product. Solution Update the Software Update the software to the latest version...

Security Bulletin: IBM Maximo Asset Management - A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2024-22354)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera, and...

Information Leakage Vulnerability in Equipment Asset Comprehensive Control Platform of Guangdong Zhongshi Intelligent Control Technology Co.

Guangdong Zhongshi Intelligent Control Technology Co., Ltd. is a specialized enterprise in the field of high-tech, with industrial Internet and smart city digital technology innovation application as its core business. There is an information leakage vulnerability in the equipment asset integrate...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2024-25026)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Security Bulletin: IBM WebSphere Application Server Liberty is vulnerable to a denial of service when using the openidConnectClient-1.0 or socialLogin-1.0 feature.(CVE-2024-22353)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera, and...

Security Bulletin: There is a vulnerability in tinymce-6.8.1.min.js used by IBM Maximo Asset Management application (CVE-2024-38357, CVE-2024-38356)

Summary There is a vulnerability in tinymce-6.8.1.min.js used by IBM Maximo Asset Management application. Vulnerability Details CVEID:CVE-2024-38357 DESCRIPTION: TinyMCE is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the noscript elements. A remote...