The vulnerability of the cloud platform for protecting applications from unauthorized users and Cisco Duo devices for Windows, related to authentication procedures that allow a intruder to gain access to the vulnerable device.

The vulnerability of the cloud platform for protecting applications from unauthorized users and Cisco Duo devices for Windows is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a hacker to gain access to the vulnerable device...

Qualys Updates Login Page to Improve User Experience and Highlight Latest Qualys News

With an eye to updating the overall user experience UI, continuing to fortify security, and keeping you informed of the latest Qualys news, were optimizing our login at the end of May 2024. This UI overhaul of sorts aims not only to refresh the aesthetic appeal but also to integrate robust...

USN-6681-1: Linux kernel vulnerabilities

Wenqing Liu discovered that the f2fs file system implementation in the Linux kernel did not properly validate inode types while performing garbage collection. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service system...

USN-6625-2: Linux kernel (GCP) vulnerabilities

Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service paravirtualized device unavailability. CVE-2023-34324 Zheng Wang discovered...

Google Cloud Platform Detected

This is an informational notice that the scanner was able to detect that the target application is using an Google Cloud cloud service. No source data...

Google Extensible Service Proxy 2.20.0 < 2.43.0 Authentication Bypass

Google Extensible Service Proxy ESP is a scalable proxy provided by the Google Cloud Platform GCP used to provide API management features based on an OpenAPI or gRPC API backend. ESP versions starting 2.20.0 and before 2.43.0 suffer from an authentication bypass vulnerability. By crafting a...

Express.js Authentication Bypass

Express.js is a popular web framework for Node.js. Google Extensible Service Proxy ESP is a scalable proxy provided by the Google Cloud Platform GCP used to provide API management features based on an OpenAPI or gRPC API backend. When an Express.js API is deployed with case insensitive routing se...

SQL Injection Vulnerability in Active Security Monitoring Cloud Platform of Dongguan Tongtianxing Software Technology Company Limited (CNVD-2024-07950)

Dongguan Tongtianxing Software Technology Co., Ltd. is a video security service provider. Dongguan Tongtianxing Software Technology Co., Ltd. active security monitoring cloud platform has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the...

Dongguan Tongtianxing Software Technology Co., Ltd. active security monitoring cloud platform has unauthorized access vulnerabilities

Dongguan Tongtianxing Software Technology Co., Ltd. is a video security service provider. Dongguan Tongtianxing Software Technology Co., Ltd. active security monitoring cloud platform has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2023-50253

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

Design/Logic Flaw

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

CVE-2023-50253 laf logs leak

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...

CVE-2023-49791 Workflows do not require password confirmation on API level

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an...

CVE-2023-49791

CVE-2023-49791 affects Nextcloud Server and Nextcloud Enterprise Server where an attacker with an active session of another user could call the API to delete/modify workflows without password confirmation, bypassing the UI check. The description lists affected ranges: Nextcloud Server pre-26.0.9 ...

Code injection

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

USN-6534-2: Linux kernel vulnerabilities

It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain situations, leading to a out-of-bounds read vulnerability. A local attacker could possibly use this to cause a denial of service system crash. CVE-2023-37453 Lin Ma...

USN-6537-1: Linux kernel (GCP) vulnerabilities

Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service system crash. CVE-2023-31085 Lucas Leong discovered that the netfilter subsystem in the...

Unauthorized Access Vulnerability in Jianguoyun-Engineering Digitization Cloud Platform of Zhuhai Enterprise Surplus Information Technology Co.

Zhuhai Enterprise Information Technology Co., Ltd. focuses on the development and operation services of the SaaS platform Jian Guo Yun for the digital intelligence of the engineering and construction industry. There is an unauthorized access vulnerability in the Engineering Digital Cloud Platform...

USN-6494-2: Linux kernel vulnerabilities

Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged attacker could use this to cause a denial of service system crash. CVE-2023-31085 Lucas Leong discovered that the netfilter subsystem in the...

USN-6496-2: Linux kernel vulnerabilities

Ivan D Barrera, Christopher Bednarz, Mustafa Ismail, and Shiraz Saleem discovered that the InfiniBand RDMA driver in the Linux kernel did not properly check for zero-length STAG or MR registration. A remote attacker could possibly use this to execute arbitrary code. CVE-2023-25775 Yu Hao discover...