Critical Flaws Disclosed in Device42 IT Asset Management Software

Cybersecurity researchers have disclosed multiple severe security vulnerabilities asset management platform Device42 that, if successfully exploited, could enable a malicious actor to seize control of affected systems. "By exploiting these issues, an attacker could impersonate other users, obtain...

Wyse Management Suite has an unspecified vulnerability (CNVD-2022-56656)

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, Inc. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery.A security vulnerability exists in Wyse Management Suite 3.6.1 and prior versions,...

Wyse Management Suite has an unspecified vulnerability (CNVD-2022-56660)

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, Inc. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery.Wyse Management Suite 3.6.1 and prior versions contain a security vulnerability that...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to information disclosure CVE-2022-30629

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to information disclosure CVE-2022-30629 with details below Vulnerability Details CVEID:CVE-2022-30629 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by a...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to CVE-2022-31129

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to CVE-2022-31129 with details below Vulnerability Details CVEID:CVE-2022-31129 DESCRIPTION: Moment is vulnerable to a denial of service, caused by inefficient regular expression complexity. By sendi...

Know Your ServiceNow and Qualys Integrations

If you are a current ServiceNow customer interested in cybersecurity, this blog is for you. If you are a Qualys customer who also uses ServiceNow, this blog is for you too. ServiceNow and Qualys have enjoyed a multi-year partnership, being two of the premier SaaS vendors covering the IT and...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to CVE-2022-24434

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to CVE-2022-24434 Vulnerability Details CVEID:CVE-2022-24434 DESCRIPTION: Node.js dicer module is vulnerable to a denial of service. By sending a specially-crafted form to server, a remote attacker...

A Deep Dive into VMDR 2.0 with Qualys TruRisk™

The old way of ranking vulnerabilities doesn’t work anymore. Instead, enterprise security teams need to rate the true risks to their business. In this blog, we examine each of the risk scores delivered by Qualys TruRisk, the criteria used to compute them, and how they can be used to prioritize...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to OpenSSL CVE-2022-0778

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to OpenSSL CVE-2022-0778 with details below Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2021-43565

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Go CVE-2021-43565 with details below Vulnerability Details CVEID:CVE-2021-43565 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an input validation...

The MIMOVaultActions contract cannot withdraw assets to the user

Lines of code Vulnerability details Impact The MIMOVaultActions contract provides users with the functions of depositing, withdrawing and borrowing assets, which is called by the delegatecall of the MIMOProxy contract. But when borrowing or withdrawing assets, there is no function provided to giv...

rbData.toCollateral address can be different than the token address set in swapData.dexTxData.

Lines of code Vulnerability details Impact rbData.toCollateral address can be different than the token address set in swapData.dexTxData. A manager can supply toCollateral address of the collateral within the contract but supply a different address in swapParams.dexTxData such that the contract...

Maritime regulation. All Hands-on Deck!

TL;DR The regulation from the IMO has changed, you need to do more about cyber security. Key things to focus on: Start asking questions of your supply chain, of your own IT and OT teams Assess the security configuration per vessel – each are different Use Critical National Infrastructure controls...

Manager can drain vault by taking flashloan in unexpected currency

Lines of code Vulnerability details Impact Manager can drain vault Proof of Concept address fromCollateral = vaultsData.vaultCollateralTypevaultId; uint256 rebalanceValue = priceFeed.convertFromfromCollateral, rebalanceAmount; The source of the exploit is that the above lines wrongly assume that...

The current cybersecurity challenge: All the threat data in the world, but no idea how to leverage it

Milpitas, California, August 05, 2022 -- Organizations today are facing a deluge of automated cybersecurity threats that are increasing exponentially every day, not only in velocity but in variety and complexity. This makes it virtually impossible for organizations to address every vulnerability...

Introducing CyberSecurity Asset Management 2.0 with Natively Integrated External Attack Surface Management

Qualys is introducing Qualys CyberSecurity Asset Management 2.0, which now delivers natively integrated External Attack Surface Management EASM to enable Cybersecurity teams to identify any and all assets visible on the internet, including previously unknown assets and any potential security...

Citadel 跨站脚本漏洞

Citadel is an asset management software from Citadel, Inc. in the United States. A cross-site scripting vulnerability exists in Citadel client version 7.1.1 and earlier, which stems from the embedded neutralization of a Script-Related HTML Tag, and can be bypassed under a number of additional...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A security vulnerability exists in Discourse stable 2.8.6 and earlier, Discourse beta 2.9.0.beta7 and earlier, and Discourse tests-passed 2.9.0.beta7 and earlier, whi...

Vulnerabilities are Beyond What You Think

A software vulnerability is a weakness in an operating system or application that can be exploited by an attacker to invade an IT network. When publicly disclosed, these software vulnerabilities are usually assigned a CVE identifier. CVE is a popular term when referring to a vulnerability, and 50...

Attack Surface Management: a Critical Pillar of Cybersecurity Asset Management

In their recent Innovation Insight for Attack Surface Management report, Gartner calls Attack Surface Management or “ASM”, for short the first pillar in a broader Exposure Management strategy. According to Gartner, ASM addresses the questions: What does my organization look like from an attacker’...