Creating an Exceptional Workplace: Building and Expansion in a Post-COVID World

Since its launch in 2011, Rapid7 UK has been on a mission to build a strong footprint in the region. Today, the company is celebrating the opening of its newly expanded and designed Reading office, located in the Thames Valley District at Forbury Place. This new location was selected to reflect...

Simplessus 路径遍历漏洞

Simplessus is a modern software for managing customer relationships from the German company Simplessus. A security vulnerability exists in Simplessus version 3.7.7 that stems from a path traversal vulnerability in Simplessus...

Design/Logic Flaw

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship e.g., created by, updated by with content accessible to the authenticated user. For example, a...

NewStart CGSL CORE 5.04 / MAIN 5.04 : exiv2 Multiple Vulnerabilities (NS-SA-2022-0012)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has exiv2 packages installed that are affected by multiple vulnerabilities: - Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in...

Vulnerabilities fixed in Oracle Hyperion

Oracle has fixed vulnerabilities in the following Hyperion products: Hyperion BI+ Hyperion Data Relationship Management Hyperion Financial Management Hyperion Infrastructure Technology Hyperion Planning Hyperion Profitability and Cost Management Hyperion Calculation Manager Hyperion Tax Provision...

ICSJWG Spring 2022 Virtual Meeting

The Industrial Control Systems Joint Working Group ICSJWG will hold its Spring 2022 Virtual Meeting April 26–27. ICSJWG meetings facilitate relationship building among critical infrastructure stakeholders and owners/operators of industrial control systems, idea exchanges regarding critical issues...

Finding Attack Paths in Cloud Environments

The mass adoption of cloud infrastructure is fully justified by innumerable advantages. As a result, today, organizations' most sensitive business applications, workloads, and data are in the cloud. Hackers, good and bad, have noticed that trend and effectively evolved their attack techniques to...

Reflecting on Women’s History Month at Rapid7

During Women’s History Month, we invited some of our team members to share their best advice for other women in technology, celebrate their strengths, and reflect on how they’ve challenged convention within their roles and built their networks. What is the best advice that someone has given you i...

How to pay professional maintainers

I work on the Go team at Google, but this is my personal opinion as someone who built a career on Open Source both at and outside big companies. In a previous essay, Professional maintainers: a wake-up call, I argued that we need Open Source maintainers to professionalize into a role thats legibl...

CVE-2021-33853

A Cross-Site Scripting XSS attack can cause arbitrary code javascript to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the...

SalesAgility SuiteCRM 安全漏洞

Salesagility SalesAgility SuiteCRM is a suite of enterprise-grade, open source Customer Relationship Management CRM from Salesagility UK. A security vulnerability exists in SalesAgility SuiteCRM that stems from incorrect authorization in the GitHub repository salesagility suitecrm prior to 7.12.5...

SAP NetWeaver Application Server 资源管理错误漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A resource management error vulnerability exists in SAP NetWeaver Application Server, which can be exploited by an attacker to compromise vulnerable systems including Business Objects, SAP CRM Web Channel, SAP CRM, SAP...

Sap Crm Web Channel 信息泄露漏洞

Sap Crm Web Channel is an e-commerce management system from SAP Germany. It is used to transform the Internet into profitable sales and provide customer satisfaction and convenience to business partners. An information disclosure vulnerability exists in SAP CRM Web Channel, which can be exploited...

SAP多个产品环境问题漏洞

SAP NetWeaver Application Server Java is an application server that provides a Java runtime environment.SAP NetWeaver Application Server is an application server.SAP ERP is a series of software for ERP management.SAP CRM is a customer relationship management system. SAP NetWeaver Application Serv...

SAP Solution Manager 安全漏洞

SAP Solution Manager is a system management platform from SAP Germany that integrates system monitoring, SAP support desktops, self-service, ASAP implementation, etc. SAP Solution Manager has a security vulnerability that can be exploited by attackers to compromise vulnerable systems, including...

SAP 3D Visual Enterprise Viewer 输入验证错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D view viewer from SAP, Germany. The software supports publishing of 2D and 3D scenes in all industry-standard desktop applications and supports separate installations with standalone executables and ActiveX space. An input validation error vulnerability exis...

SAP ERP HCM 安全漏洞

SAP ERP HCM is an enterprise human resource management solution from SAP, Germany. A security vulnerability exists in SAP ERP HCM that can be exploited by attackers to compromise vulnerable systems, including Business Objects, SAP CRM Web Channel, SAP CRM, SAP ERP, NetWeaver, ASE...

SAP多个产品输入验证错误漏洞

SAP 3D Visual Enterprise Viewer is a 3D viewer, SAP ERP is a series of software for ERP management, SAP CRM is a customer relationship management system, Sap Crm Web Channel is an e-commerce management system. Sap Crm Web Channel is an e-commerce management system. An input validation error...

SAP NetWeaver AS SQL注入漏洞

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. SAP NetWeaver AS has a SQL injection vulnerability that can be exploited by attackers to threaten vulnerable systems, including Business Objects, SAP...

SAP多个产品环境问题漏洞

SAP NetWeaver Application Server Java and SAP NetWeaver Application Server are both products of SAP Germany.SAP NetWeaver Application Server Java is an application server that provides a Java runtime environment. SAP NetWeaver Application Server Java is an application server that provides a Java...