USN-3718-1: Linux kernel regression

USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression where insufficient early entropy prevented services from starting, leading in some situations to a failure to boot, This update addresses the issue. We...

USN-3695-1: Linux kernel vulnerabilities

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly initialize the crc32c checksum driver. A local attacker could use this to cause a denial of service system crash. CVE-2018-1094 It was discovered that the cdrom driver in the Linux kernel contained an...

Qualys Cloud Platform (VM, SCA, PC) 8.14 New Features

This new release of the Qualys Cloud Platform VM, SCA, PC, version 8.14, includes several new feature improvements across the apps such as Wallix AdminBastion support, EC2 scan improvements, VM reporting improvements, ESX/ESXi PC support for vCenter, PC STIG Report, and expanded technology suppor...

Security Bulletin: InfoSphere Information Server is vulnerable to XML External Entity Injection (XXE) (CVE-2016-6059)

Summary IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. Vulnerability Details CVEID: CVE-2016-6059 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to a denial of service, caused by ...

QSC18 Virtual Edition – Building Security In: The Qualys Cloud Platform and Architecture

Digital transformation, driven primarily by the DevOps movement, represents a new opportunity “to redo IT from scratch, but more importantly, to redo security from scratch,” Sumedh Thakar, Qualys' Chief Product Officer, said during QSC18 Virtual Edition. Specifically, organizations can organicall...

QSC18 Virtual Edition – Securing our Networks and Enabling the Digital Transformation: One App at a Time

Qualys Chairman and CEO Philippe Courtot set the tone for the company’s first virtual conference, the QSC18 Virtual Edition, with a call to the industry to re-invent security to protect digital transformation efforts. CIOs and CISOs can’t continue accumulating disparate, point solutions that are...

Qualys Cloud Platform 2.33 New Features

This release of the Qualys Cloud Platform version 2.33 includes the release for CertView, plus updates and new features for AssetView, Cloud Agent, EC2 Connector, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. This posting has bee...

QSC 2018 Mumbai Finds Qualys at the Forefront of Digital Transformation Security

Qualys Security Conference 2018, held in Mumbai on May 10, fortified Qualys’ stand as the leader in securing Digital Transformation in the current global IT landscape. In his keynote, “Our Journey into the Cloud: The Qualys Platform and Architecture”, Qualys Vice President of Product Management...

Qualys: Cloud Security Must Move Towards ‘Transparent Orchestration’

What does the “My Little Pony” television series and cyber security have in common? Ask Qualys Chief Product Officer Sumedh Thakar. Whenever his 7-year old daughter wanted to see an episode of this show, the process involved multiple steps: Turning on the smart TV, scrolling through the app menu,...

SAP Cloud Platform Session Fixation Vulnerability

SAP Cloud Platform is an open Platform-as-a-Service PaaS cloud platform from SAP. The platform is used to build and extend personalized, collaborative and mobile-enabled cloud applications. A session fixation vulnerability exists in SAP Cloud Platform version 2.0, which stems from the program...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

Input validation

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2409

Improper session management when using SAP Cloud Platform 2.0 Connectivity Service and Cloud Connector. Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform...

CVE-2018-2409

The CVE-2018-2409 issue affects SAP Cloud Platform 2.0 components (Connectivity Service and Cloud Connector). The root cause is improper session management, which can allow data from another user to be shown or modified when applications built on SAP Cloud Platform are used. In practice, this lea...

Qualys Cloud Platform (VM, PC) 8.13 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.13, includes several new feature improvements across the apps such as the ability to test authentication records, as well as improvements to UDC’s and report options in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platfo...

CVE-2018-1197

In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials...

CVE-2018-1197

In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials...

Design/Logic Flaw

In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials...

CVE-2018-1197

The CVE affects Cloud Foundry Windows Stemcells prior to 1200.14. In these versions, apps running inside containers on Windows in Google Cloud Platform could access the GCP metadata endpoint, enabling a malicious developer to obtain privileged credentials. Root cause: exposure of the metadata end...