Video Training Update, July 2019

The Qualys Training team released a major update to the Vulnerability Management Certified Training Course. We’ve also built out two new video libraries showing how to assess business process risk and how to secure cloud infrastructures in DevSecOps environments using AWS Golden AMI pipelines. An...

Access Control Vulnerabilities in Multiple ZyXEL Products

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. A security vulnerability exists ...

Cross-site scripting vulnerability in multiple Zyxel devices

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. Zyxel ZyWall A cross-site...

CVE-2019-12581

A reflective Cross-site scripting XSS vulnerability in the freetimefailed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter...

The vulnerabilities of the software for Cisco TelePresence Video Communication Server and Cisco Expressway Series, as well as the Unified Communications Manager IM and Presence Service software, are due to insufficient validation of input data. This allows attackers to trigger service failures.

The vulnerabilities of the Cisco TelePresence Video Communication Server and Cisco Expressway Series software, as well as the Unified Communications Manager IM and Presence Service software, exist due to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers t...

The vulnerability of the monitoring panel for Cisco Unified Intelligence Center’s reporting functions allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the monitoring panel for creating Cisco Unified Intelligence Center reports is related to improper control of resource identifiers. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information by usin...

Microsoft Teams help & learning

None None...

High-Severity Bug in Cisco Industrial Enterprise Tool Allows RCE

A high-severity bug has been found that allows remote attackers to hijack Cisco’s enterprise-class Industrial Network Director. The vulnerability was made public Wednesday along with a patch; there are no workarounds for the bug and a software patch is required, Cisco said. Cisco’s Industrial...

The vulnerability of the Unified Write Filter (UWF) in the Windows operating system allows a hacker to increase their privileges.

The vulnerability of the Unified Write Filter UWF in the Windows operating system is related to the lack of restrictions on access to the registry. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2019-1845

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence Unified CM IM&P Service, Cisco TelePresence Video Communication Server VCS, and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users...

CVE-2019-1845 Cisco Unified Communications Manager IM&P Service, Cisco TelePresence VCS, and Cisco Expressway Series Denial of Service Vulnerability

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence Unified CM IM&P Service, Cisco TelePresence Video Communication Server VCS, and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users...

CVE-2019-1845 Cisco Unified Communications Manager IM&P Service, Cisco TelePresence VCS, and Cisco Expressway Series Denial of Service Vulnerability

A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence Unified CM IM&P Service, Cisco TelePresence Video Communication Server VCS, and Cisco Expressway Series could allow an unauthenticated, remote attacker to cause a service outage for users...

CVE-2019-1845

The CVE-2019-1845 entry affects Cisco Unified Communications Manager IM&P Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series. The root cause is insufficient controls for specific memory operations, allowing an unauthenticated, remote attacker to send a malfo...

Cisco Unified Computing System BIOS Signature Bypass Vulnerability

A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System UCS C-Series Rack Servers could allow an authenticated, local attacker to install compromised BIOS firmware on an affected device. The vulnerability is due to insufficient validation of the firmware image file. An...

The vulnerability of the command-line interface of Cisco UCS Blade Series B software allows a hacker to write arbitrary files.

The vulnerability of the command-line interface of Cisco UCS Blade series B micro-programming system software is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to write arbitrary files by modifying the command-line interface parameters...

The vulnerability of the User Data Services (UDS) software interface of the Cisco Unified Communications Manager (Unified CM) platform allows a perpetrator to trigger a service failure.

The vulnerability of the User Data Services UDS software interface of the Cisco Unified Communications Manager Unified CM platform is related to insufficient validation of entered data. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially...

Cisco Expressway Gateway 11.5.1 Directory Traversal Vulnerability

Exploit for hardware platform in category web applications Cisco Expressway Gateway 11.5.1 Directory Traversal Vulnerability Details ======= Product: Cisco Expressway Gateway Affected Versions: 11.5.1, possibly others Fixed Versions: See Cisco Bug ID CSCvo47769 1 Vulnerability Type: Directory...

CVE-2019-4293

IBM Storwize V7000 Unified 2073 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further attacks against the system. IBM X-Force ID: 160699...

Default configuration

IBM Storwize V7000 Unified 2073 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further attacks against the system. IBM X-Force ID: 160699...

CVE-2019-4293

IBM Storwize V7000 Unified 2073 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further attacks against the system. IBM X-Force ID: 160699...