1064 matches found
SAP Commerce Cloud 跨站脚本漏洞
SAP Commerce Cloud is a set of cloud-based e-commerce platform from Germany's SAP. It supports sales management, marketing management, order management, and operations management. SAP Commerce Cloud suffers from a cross-site scripting vulnerability that stems from a vulnerability in MIME sniffing...
SQL Injection Vulnerability in Starfire Cloud Platform System
The business scope of Beijing Shengshi Starfire Education Technology Limited Liability Company includes technology development, computer animation design, education consulting, and rental of office space. A SQL injection vulnerability exists in the Starfire Cloud Platform system. An attacker can...
Weak Password Vulnerability in Riptide Networks MCP Marketing Cloud Platform
MCP Cloud Marketing Platform is a wireless advertisement push platform system developed by Ruijie Networks for commercial places such as trade chains, hotels, shopping centers, wireless cities, transportation stations, tourist attractions and other commercial places with advertisement marketing...
Logic Flaw Vulnerability in Education Cloud Platform System of Beijing Zhongke Liancheng Software Co.
Ltd. was founded in 2012, is a comprehensive software and information services of high-tech dual-soft enterprise. A logic flaw exists in the education cloud platform system of Beijing Zhongke Liancheng Software Company Limited, which can be exploited by attackers to obtain sensitive information...
CVE-2020-28722
Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting XSS vulnerability that can lead to an account takeover via custom email templates...
Cross site scripting
Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting XSS vulnerability that can lead to an account takeover via custom email templates...
CVE-2020-28722
Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting XSS vulnerability that can lead to an account takeover via custom email templates...
CVE-2020-28722
CVE-2020-28722 affects Deskpro Cloud Platform and on‑premise Deskpro 2020.2.3.48207. The vulnerability is a cross-site scripting (XSS) flaw in custom email templates that can lead to an account takeover. The provided connected documents confirm the product, version, and impact, but do not include...
Unauthorized Access Vulnerability in Management Information Technology Practical Training Cloud Platform of Changjie Tong Information Technology Co.
Ltd. is a company dedicated to providing platform services, application services, and value-added data services centered on financial and management services for small and medium-sized enterprises in China. An unauthorized access vulnerability exists in the Management Information Technology...
Deskpro 跨站脚本漏洞
Deskpro is a suite of helpdesk software from Deskpro UK. The software includes, among other things, a customer relationship management component that provides features such as email, live chat, and voice. A cross-site scripting vulnerability exists in Deskpro Cloud Platform. The vulnerability cou...
Terraform’s Vault Provider Did Not Correctly Configure Bound Labels for GCP Auth
Summary Terraform’s Vault Provider terraform-provider-vault did not correctly configure GCE-type bound labels for Vault’s GCP auth method. This vulnerability, CVE-2021-30476, was fixed in terraform-provider-vault 2.19.1. Background Terraform’s Vault Provider...
Sish - HTTP(S)/WS(S)/TCP Tunnels To Localhost Using Only SSH
An open source serveo/ngrok alternative. Deploy Builds are made automatically for each commit to the repo and are pushed to Dockerhub. Builds are tagged using a commit sha, branch name, tag, latest if released on main. You can find a list here. Each release builds separate sish binaries that can ...
Qualys API Best Practices: Host List API
When you’re looking to add automation to your vulnerability management and policy compliance program, a good starting point is the Host List, which is your scanned asset inventory. More precisely, it represents which assets have been scanned and when for Qualys Vulnerability Management VM or Poli...
What’s New in InsightIDR: Q1 2021 in Review
Back at the start of the year, we reflected on some of our 2020 InsightIDR product investments and took a look at what was ahead in 2021 see the blog here. As the first quarter of the year comes to a close, we wanted to offer a closer look at some of the recent updates and releases in InsightIDR,...
Extending your FedRAMP Program to Container Infrastructure with the Qualys Cloud Platform
Following the recent release of the FedRAMP Vulnerability Scanning Requirements for Containers, FedRAMP-authorized systems that make use of containers have one month from March 16, 2021 to submit a plan for compliance with the new requirements. Organizations with a need to certify their services...
USN-4887-1: Linux kernel vulnerabilities
De4dCr0w of 360 Alpha Lab discovered that the BPF verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker could use this to expose sensitive information kernel memory or possibly execute arbitrary code...
Information Disclosure Vulnerability in Panavision OA
Panavision OA is an all-in-one mobile office cloud platform. An information disclosure vulnerability exists in Panmicro OA. An attacker can exploit the vulnerability to gain unauthorized access to database logs...
USN-4751-1: Linux kernel vulnerabilities
It was discovered that the console keyboard driver in the Linux kernel contained a race condition. A local attacker could use this to expose sensitive information kernel memory. CVE-2020-25656 Minh Yuan discovered that the tty driver in the Linux kernel contained race conditions when handling...
