Vulnerabilities fixed in SAP products

SAP has released updates for several products, including SAP BASIS, Netweaver, HAMA, Business Planning & Consolidation, SAP CRM and SAP Solution Manager. A malicious party could potentially exploit and cause damage in the following categories: Cross-Site Scripting XSS Bypassing authentication...

A Customer Success Manager’s Journey to Cybersecurity

Originally planning to pursue a career in sports journalism, Blake Walters joined Rapid7 ready to roll up his sleeves and learn about an entirely new field—cybersecurity. Walters always had an interest in computer engineering. However, he craved the ability to connect with people and build...

[SECURITY] Fedora 37 Update: tor-0.4.7.13-1.fc37

The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor's users employ this network by connecting through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and...

ridhoq soundslike SQL注入漏洞

soundslike is an application by the individual developers of ridhoq. Enables users to discover music by traversing a music relationship graph constructed by other users. An SQL injection vulnerability exists in ridhoq soundslike. An attacker could exploit this vulnerability to cause sql injection...

PT-2025-49737

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.4.0-rc7-syzkaller-00041-ge660abd551f1 Description The Linux kernel contains a flaw within the f2fs file system related to handling inode truncation. Specifically, a missing sanity check in the truncate dnode...

CVE-2022-43875

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or managing these authorizations. IBM X-Force ID: 240034...

PT-2022-26197 · Zoho · Zoho Crm Lead Magnet Plugin

Name of the Vulnerable Software and Affected Versions: Zoho CRM Lead Magnet plugin versions = 1.7.5.8 Description: The issue allows authenticated users with subscriber or higher privileges to update arbitrary options. Recommendations: For Zoho CRM Lead Magnet plugin versions = 1.7.5.8, update to ...

72crm 代码问题漏洞

72crm is China's 72crm open source based on TP5.0 + ElementUI of the former CRMvueCRM system . 72crm 9.0 version has a security vulnerability , the vulnerability stems from the existence of arbitrary file upload vulnerability...

Pegasystem PEGA Platform 跨站脚本漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications such as BPM business process management, case management, real-time decision making and CRM customer relationship management.Pegasystem PEGA Platform has a...

Creating an Exceptional Workplace: Building and Expansion in a Post-COVID World

Since its launch in 2011, Rapid7 UK has been on a mission to build a strong footprint in the region. Today, the company is celebrating the opening of its newly expanded and designed Reading office, located in the Thames Valley District at Forbury Place. This new location was selected to reflect...

Simplessus 路径遍历漏洞

Simplessus is a modern software for managing customer relationships from the German company Simplessus. A security vulnerability exists in Simplessus version 3.7.7 that stems from a path traversal vulnerability in Simplessus...

Design/Logic Flaw

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship e.g., created by, updated by with content accessible to the authenticated user. For example, a...

NewStart CGSL CORE 5.04 / MAIN 5.04 : exiv2 Multiple Vulnerabilities (NS-SA-2022-0012)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has exiv2 packages installed that are affected by multiple vulnerabilities: - Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in...

Vulnerabilities fixed in Oracle Hyperion

Oracle has fixed vulnerabilities in the following Hyperion products: Hyperion BI+ Hyperion Data Relationship Management Hyperion Financial Management Hyperion Infrastructure Technology Hyperion Planning Hyperion Profitability and Cost Management Hyperion Calculation Manager Hyperion Tax Provision...

ICSJWG Spring 2022 Virtual Meeting

The Industrial Control Systems Joint Working Group ICSJWG will hold its Spring 2022 Virtual Meeting April 26–27. ICSJWG meetings facilitate relationship building among critical infrastructure stakeholders and owners/operators of industrial control systems, idea exchanges regarding critical issues...

Finding Attack Paths in Cloud Environments

The mass adoption of cloud infrastructure is fully justified by innumerable advantages. As a result, today, organizations' most sensitive business applications, workloads, and data are in the cloud. Hackers, good and bad, have noticed that trend and effectively evolved their attack techniques to...

Reflecting on Women’s History Month at Rapid7

During Women’s History Month, we invited some of our team members to share their best advice for other women in technology, celebrate their strengths, and reflect on how they’ve challenged convention within their roles and built their networks. What is the best advice that someone has given you i...

How to pay professional maintainers

I work on the Go team at Google, but this is my personal opinion as someone who built a career on Open Source both at and outside big companies. In a previous essay, Professional maintainers: a wake-up call, I argued that we need Open Source maintainers to professionalize into a role thats legibl...

SalesAgility SuiteCRM 安全漏洞

Salesagility SalesAgility SuiteCRM is a suite of enterprise-grade, open source Customer Relationship Management CRM from Salesagility UK. A security vulnerability exists in SalesAgility SuiteCRM that stems from incorrect authorization in the GitHub repository salesagility suitecrm prior to 7.12.5...

SAP多个产品输入验证错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D viewer, SAP ERP is a series of software for ERP management, SAP CRM is a customer relationship management system, Sap Crm Web Channel is an e-commerce management system. Sap Crm Web Channel is an e-commerce management system. An input validation error...