Vault’s GCP Auth Method Allows Authentication Bypass

Summary A vulnerability was identified in Vault and Vault Enterprise “Vault” such that, with the GCP Auth Method configured and under certain circumstances, the values relied upon by Vault to validate Google Compute Engine GCE VMs may be manipulated and authentication bypassed. This vulnerability...

Securing Containers in Google Cloud Artifact Registry with Qualys

Container software supply chain is an area of concern for security teams in large and small enterprises because developers often make use of container images from a variety of public repositories. A single insecure container image can be instantiated several times and lead to a wide, diffused...

Defining Vulnerability Risk Management (and How to Build a Modern VRM Program)

Once upon a time just a handful of years ago, vulnerability management programs focused solely on servers, running quarterly scans that targeted only critical systems. But that was then, and you can’t afford such a limited view in the now. Truth is, vulnerability exploitation now happens...

Hangzhou Supercomputer IOT Technology Co., Ltd. unauthorized access vulnerability exists in Vida's foreign trade management cloud platform

Vinda foreign trade software was founded in January 2006, is committed to foreign trade enterprise customer resource management system research and development, sales and service; Hangzhou Supercomputer IOT Technology Co., Ltd Vinda foreign trade management cloud platform there is an unauthorized...

Building an Open Cloud Platform

Qualys Chairman and CEO Philippe Courtot kicked off QSC USA 2020, the company’s 20th annual user conference, with an assessment of current security challenges, and a clear call to action on how to successfully overcome them. “Today security is front and center, and as we move to the cloud, we mus...

VMware Issues Updated Fix For Critical ESXi Flaw

VMware issued an updated fix for a critical-severity remote code execution flaw in its ESXi hypervisor products. Wednesday’s VMware advisory said updated patch versions were available after it was discovered the previous patch, released Oct. 20, did not completely address the vulnerability. That’...

Command Execution Vulnerability in NC Cloud of UFIDA Network Technology Corporation (CNVD-2020-64877)

NC Cloud is a digital platform for large enterprises, focusing on digital management, digital operation and digital business, helping large enterprises realize the comprehensive digitalization of people, money, goods and customers. A command execution vulnerability exists in NC Cloud of UFIDA...

Shenzhen Huazhou Intelligent Manufacturing Technology Co., Ltd. Huazhou Cloud Industrial Internet Platform Exists SQL Injection Vulnerability

Headquartered in Shenzhen, China, Huazhou Intelligence is committed to globalization and technological innovation, and has set up overseas offices and research institutes in Germany, Japan, the United States and other countries. With the Industrial Internet Platform as the core carrier, Huasic...

Unauthorized Access Vulnerability in Yuexun Smart Education Cloud Platform (CNVD-2020-59801)

Yuexun Smart Education Platform is an educational software. Unauthorized access vulnerability exists in Yuexun Intelligent Education Cloud Platform. An attacker can use the vulnerability to overstep the authority to manage all personnel accounts and obtain sensitive information by modifying other...

Huawei FusionAccess Command Execution Vulnerability

Huawei FusionAccess is a virtual desktop application based on Huawei Cloud Platform from Huawei, China. A security vulnerability exists in Huawei FusionAccess version 6.5.1. The vulnerability stems from a command being authorized with incorrect privileges. An attacker could exploit the...

Unauthorized Access Vulnerability in Yuexun Smart Education Cloud Platform

Yuexun Smart Education Platform is an educational software. An unauthorized access vulnerability exists in Yuexun Intelligent Education Cloud Platform. An attacker can exploit the vulnerability to log in unauthorized and perform unauthorized operations...

Integrate Security into Your GCP with Google Cloud SDK

Dive into this how to guide on integrating Trend Micro Cloud One™ – Workload Security with Google Cloud Platform™...

What's New in Edge Delivery

Welcome to day two of the Akamai Platform Update! Today, we're focusing on Akamai's edge delivery products as well as other complimentary products that help drive great digital experiences. The last several months have been nothing short of unprecedented as lockdowns, quarantines, and other...

PAN-OS Critical Buffer Overflow Vulnerability (CVE-2020-2040) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®

On Sept 9, 2020, Palo Alto Networks published nine security bulletins addressing vulnerabilities in PAN-OS operating system versions 8.0 or later. One of the nine CVEs released, CVE-2020-2040, received a critical severity rating score of 9.8 based on the CVSS v3 Scoring system. PAN-OS devices are...

VPS-Docker-For-Pentest - Create A VPS On Google Cloud Platform Or Digital Ocean Easily With The Docker For Pentest

Create a VPS on Google Cloud Platform or Digital Ocean easily with the docker for pentest included to launch the assessment to the target. Requirements Terraform installed Ansible installed SSH private and public keys Google Cloud Platform or Digital Ocean account. Usage 1.- Clone the repository...

Information Leakage Vulnerability in Aicloud Education Cloud Platform of Tianwen Digital Media Technology (Beijing) Co.

AiCloud education cloud platform is a system that meets the needs of education informatization 2.0 era construction in the mode of "platform+application+resources+services", and is constructed in five aspects, namely, intelligent management, intelligent teaching, intelligent teaching and research...

USN-4485-1: Linux kernel vulnerabilities

Timothy Michaud discovered that the i915 graphics driver in the Linux kernel did not properly validate user memory locations for the i915gemexecbuffer2ioctl. A local attacker could possibly use this to cause a denial of service or execute arbitrary code. CVE-2018-20669 It was discovered that the...

Join us at Black Hat USA 2020!

Qualys is excited to present two sponsored sessions at the Black Hat USA 2020 virtual event, open to all attendees with the free Business Hall pass. Register or log in to Black Hat USA 2020, and then view and register for these free sessions. Join us to learn about our new multi-vector EDR soluti...

USN-4426-1: Linux kernel vulnerabilities

Jason A. Donenfeld discovered that the ACPI implementation in the Linux kernel did not properly restrict loading SSDT code from an EFI variable. A privileged attacker could use this to bypass Secure Boot lockdown restrictions and execute arbitrary code in the kernel. CVE-2019-20908 Fan Yang...

Shenzhen RuiTao Information Technology Co., Ltd. RuiTao Education Cloud Resource Management Platform Has Logic Flaw Vulnerability

Ltd. was founded in 2003, headquartered in Shenzhen Nanshan District National Science and Technology Park, RuiTao puts forward the new concept of "scene recording and broadcasting", so that the recording and broadcasting into the wireless portable era. Shenzhen RuiTao Information Technology Co.,...