Customer Guidance on Recent Nation-State Cyber Attacks

Note: we are updating as the investigation continues. Revision history listed at the bottom. This post contains technical details about the methods of the actor we believe was involved in Recent Nation-State Cyber Attacks, with the goal to enable the broader security community to hunt for activit...

XSS Vulnerability in 53FastService's Online Customer Service System

Zhejiang Fast Service Group Co., Ltd. was established on August 01, 2006 . Legal representative Lou Weibo, the company's business scope includes: general items: technical services, technology development, technology consulting, technology exchanges, technology transfer, technology promotion and s...

Threat Roundup for December 4 to December 11

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 4 and Dec. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

SQL Injection Vulnerability in CRM System E4/Standard Edition of Pengwei Software Co. Ltd (CNVD-2020-72371)

Ltd. was founded in May 2004, headquartered in Shenzhen, China, has more than forty service organizations across the country, is a member of Shenzhen Software Association. It is one of the early domestic enterprises focusing on crm software research and development, and comprehensively provides...

Distinguishing Among DNS Services Part 2: The Economics

This is Part 2 of a 3-part blog series highlighting some of the distinguishing aspects of Akamai's DNS services, Edge DNS and Global Traffic Management. Part 1 focused on Akamai's DNS platform and what sets it apart. In Part 2, we take a closer look at the economics of DNS pricing models and why...

SQL Injection Vulnerability in CRM System E4/Standard Edition of Pengwei Software Co.

Pengwei Software Co., Ltd. specializes in CRM software products, solutions and technical services of innovative enterprises. A SQL injection vulnerability exists in the E4/Standard version of the CRM system of Pengwei Software Co. Ltd, which can be exploited by attackers to obtain sensitive...

Perfex CRM 2.4.4 Cross Site Scripting

Document Title: =============== Perfex v2.4.4 CRM - Print Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2231 Release Date: ============= 2020-06-24 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Threat Roundup for November 13 to November 20

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 13 and Nov. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

Two months of Black Fridays?

Black Friday began in the U.S. as a way to funnel Thanksgiving holiday free time into a day of wanton gift shopping. It later spread globally as a retailer promotional blitz to kick off the holiday shopping season. Enter: Black Friday, 2020 style. In early September, many retailers, including Hom...

Virtual Hackathon Generates Next Generation of Imperva Innovation

“How do we run a global hackathon amid a global pandemic?” That was my first thought when I began planning the 2020 Imperva Hackathon earlier this year. While the event is designed to foster innovation and uncover new ideas, in a global company like ours it’s also about making new friends and...

SQL Injection

Dolibarr/dolibarr is vulnerable to SQL injection. An authenticated user with privileges to view customer orders could perform a Time Based attack via the POST parameter objectstatus in commande/stats/index.php...

Sophos breach: Customer data exposed due to permission access flaw

By Sudais Asif Sophos has acknowledged the breach by sending email notifications to targeted customers. Here's what happened and what data was exposed. This is a post from HackRead.com Read the original post: Sophos breach: Customer data exposed due to permission access flaw...

openGauss: Restricting the Permission for the postgresql.conf File

The configuration file postgresql.conf stores the default database configuration. To prevent the parameters in the file from being tampered and protect customer information from security threats, this file directory must be protected and deny unauthorized user access. Copyright C 2020 Greenbone...

Hotfix XS80E005 - For Citrix Hypervisor 8.0

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.0. All customers who are affected by the issues described inCTX263477 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Ensure that you also installCTX258428 - Hotfix XS80E006 - For...

GaussDB Kernel: Restricting the Permission for the pg_hba.conf File

The configuration file pghba.conf stores the configuration information about database connections. To prevent the parameters in the file from being tampered and protect customer information from security threats, this file directory must be protected and deny unauthorized user access. Copyright C...

Hotfix XS80E014 - For Citrix Hypervisor 8.0

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.0. All customers who are affected by the issues described inCTX280451 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Note: This hotfix is available only to customers on theCustomer...

Akamai's Technical Enablement and Education Team, Part of the Global Services and Support Organization, Wins Four Gold, Silver, and Bronze "Excellence in Education" Awards

Akamai's Technical Enablement and Education Team won four coveted Brandon Hall Group awards for excellence in learning. Akamai's win was announced on August 20, 2020. The winners are listed on Brandon Hall Group's website. The award-winning team is responsible for creating product training and...

Safeguard Identity Data at the Source

Leverage Identity Cloud's built-in tooling to safeguard your customers' data from unnecessary exposure When your customers create an account on your website or application, they are entrusting their valuable information with you in order to establish a relationship. To maintain that relationship,...

SQL Injection Vulnerability in the Customer Platform of Shanxi Shanda Xinwang Technology Co.

Shanxi Shanda New Network Technology Co., Ltd. is a high-tech company specializing in the development of industry application software products, software services, the company has long been committed to providing enterprise management software with independent intellectual property rights,...

The vulnerability of the integration component of the Magento Commerce software development and management platform, related to authentication errors, allows attackers to gain unauthorized access to protected information and delete customer data through the REST API without authorization.

The vulnerability of the integration component of the Magento Commerce software for online store development and management is related to authentication errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and delete customer data throug...