Implement Risk-Based Vulnerability Management with Qualys TruRisk™ : Part 2

This blog is a continuation of our first blog on implementing risk-based vulnerability management with Qualys TruRiskTM. In the first blog, we covered how to correctly tag and categorize assets for accurate risk assessment. Now that you have properly tagged your assets, Qualys TruRiskTM will...

Implement Risk-Based Vulnerability Management with Qualys TruRisk™ : Part 1

For today’s CISOs, managing cyber risk is Job 1 priority, and it’s a full-time concern. Security practitioners are spending a considerable amount of time responding to cybersecurity threats and finding ways to reduce risk from threats that are unknown. Earlier this year Qualys introduced Qualys...

Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems

The maintainers of the FreeBSD operating system have released updates to remediate a security vulnerability impacting the ping module that could be potentially exploited to crash the program or trigger remote code execution. The issue, assigned the identifier CVE-2022-23093, impacts all supported...

The 9th Google Chrome Zero-Day Threat this Year – Again Just Before the Weekend

Google has released yet another security update for the Chrome desktop web browser to address a high-severity vulnerability that is being exploited in the wild. This is the ninth Chrome zero-day fixed this year by Google. This security bug CVE-2022-4262; QID 377804 is a Type Confusion vulnerabili...

Identify Server-Side Attacks Using Qualys Periscope

Qualys previously announced the introduction of Qualys Periscope in 2020. This technology allows Qualys Web Application Scanning WAS to detect out-of-band vulnerabilities such as server-side request forgery SSRF. Qualys Periscope provides confirmed detections for additional vulnerabilities, such ...

USN-5753-1: snapd vulnerability

The Qualys Research Team discovered that a race condition existed in the snapd snap-confine binary when preparing the private /tmp mount for a snap. A local attacker could possibly use this issue to escalate privileges and execute arbitrary code...

Snapd Race Condition Vulnerability in snap-confine’s must_mkdir_and_open_with_perms() (CVE-2022-3328)

The Qualys Threat Research Unit TRU has discovered a new vulnerability in snap-confine function on Linux operating systems, a SUID-root program installed by default on Ubuntu. Qualys recommends that security teams apply the patch for this vulnerability as soon as possible. In February 2022, Qualy...

Qualys Broadens Security Offerings for Oracle Cloud Infrastructure

As organizations increase their use of public cloud platforms, they encounter cloud-specific security and compliance threats, which can be challenging to address without the right tools and processes. Organizations’ cloud security difficulties lie in two main areas: Lack of visibility into their...

Don’t Spend Your Holiday Season Patching Chrome

As we come back from our Thanksgiving holidays, Google has released yet another security update for the Chrome desktop web browser to address a high-severity vulnerability that exists in the wild. This is the eighth Chrome zero-day fixed this year by Google. This security bug CVE-2022-4135; QID...

Qualys Cloud Security Agent Installed (Windows)

Binary data qualyscloudagentwininstalled.nbin...

QSC 2022: That’s a Wrap!

Over the years, the threat landscape has exploded, and bad actors have become increasingly sophisticated, making the demand for cloud security platforms - that save security teams time and increase efficiency - a must-have for every cyber arsenal. This was underscored last week at QSC 2022 Las...

QSC 2022: Listening to the Voice of the Customer

It would be redundant to state that today’s threat landscape is growing increasingly sophisticated and erratic. With all types of attacks becoming “commonplace,” the baseline for normal is abnormal. Bad actors are taking advantage of whatever attack vector they can whether that is a phishing...

QSC 2022: Qualys’ Threat Research Unit (TRU) – Our Shield Is Your Shield

Day two of QSC profiled the special launch of the Qualys Threat Research Unit, TRU. Taking the audience through a madcap tour of what the threat research unit is doing to provide intelligence and actionable insights into its census was Travis Smith, VP of Qualys Threat Research Unit. He dove deep...

QSC 2022 Day 1 Recap: Qualys Gives Organizations More Security in an Ever-Expanding Threat Landscape

The first day of Qualys’ annual security conference in Vegas was filled with a series of presentations by Qualys executives, product managers and customers’ stories about how they used the various security products. The keynotes given by Shark Tank celebrity businessman and CEO of Cyderes, Robert...

Get Your Patch Tuesday Vulnerabilities Patched on Tuesday

Every IT person is familiar with Patch Tuesdays. It’s the time of the month where IT needs to put their daily work aside and prepare for patching their entire IT environment. However, for many organizations Patch Tuesday is not a single event that occurs as an isolated point in time. It typically...

Qualys Research Alert: OpenSSL 3.0.7 – What You Need To Know

On Tuesday, November 1, 2022, the OpenSSL project released a new version of OpenSSL with version 3.0.7. This update patches two buffer overflow vulnerabilities which can be triggered in X.509 certificate verification. These vulnerabilities only apply to OpenSSL 3.x. Both these vulnerabilities are...

Don’t spend another weekend patching Chrome

As we head into the weekend, Google has released an emergency security update for the Chrome desktop web browser to address a high-severity vulnerability known to be exploited in the wild. This is the seventh Chrome zero-day fixed this year by Google. This security bug CVE-2022-3723; QID 377721 i...

Chrome Zero Day – Just Before the Weekend (again)

As we head into the weekend, Google has released an emergency security update for the Chrome desktop web browser to address a high-severity vulnerability known to be exploited in the wild. This is the seventh Chrome zero-day fixed this year by Google. This security bug CVE-2022-3723; QID 377721 i...

Qualys Research Team: Threat Thursdays, October 2022

Welcome to the third edition of the Qualys Research Team’s “Threat Research Thursday”, where we collect and curate notable new tools, techniques, procedures, threat intelligence, cybersecurity news, malware attacks, and more. Feedback on our second edition, Qualys Threat Research Thursday, is mor...

Text4Shell: Detect, Prioritize and Remediate The Risk Across On-premise, Cloud, Container Environment Using Qualys Platform

On 2022-10-13, Apache Security Team disclosed a critical vulnerability with CVE-2022-42889 affecting the popular Apache Commons Text library. This vulnerability is popularly named “Text4Shell” which when exploited can allow an unauthenticated attacker to execute arbitrary code on the vulnerable...