Policy Compliance Library Updates, May 2020

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Lark Technologies: User with single department permission can view applicant list of all department's

An endpoint was discovered that did not properly check for user permissions which could have caused unauthorized access to view pending approval requests, email addresses, and phone numbers belonging to other departments. We thank @imrannisar for reporting this to our team and confirming the...

Lark Technologies: RPC Implementation allows unauthenticated remote calls

It was found that the RPC implementation via postMessage within Lark did not check origin, so an attacker could have potentially performed RPC calls on behalf of a user. We thank @mike12 for reporting this to our team and confirming the resolution...

Tyler Technologies TylerTech Eagle Code Issue Vulnerability

Tyler Technologies TylerTech Eagle is a suite of land and official records management solutions from Tyler Technologies, USA. The product supports features such as land records management, public records self-service access, and property records management. A security vulnerability exists in Tyle...

Trading Technologies X_TRADER block_proxy_site Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trading Technologies XTRADER. Authentication is not required to exploit this vulnerability. The specific flaw exists within the messaging daemon. The issue results from the lack of proper validation ...

Trading Technologies X_TRADER remove_park Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trading Technologies XTRADER. Authentication is not required to exploit this vulnerability. The specific flaw exists within the messaging daemon. The issue results from the lack of proper validation ...

Trading Technologies X_TRADER disconnect_proxy_site Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trading Technologies XTRADER. Authentication is not required to exploit this vulnerability. The specific flaw exists within the messaging daemon. The issue results from the lack of proper validation ...

Trading Technologies X_TRADER unblock_proxy_site Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trading Technologies XTRADER. Authentication is not required to exploit this vulnerability. The specific flaw exists within the messaging daemon. The issue results from the lack of proper validation ...

Download: 'Coronavirus Cyber Security for Management' Template for CISOs

The Coronavirus crisis introduces critical operational challenges to business continuity, placing high stress on organizations' management. As a result, CIOs and CISOs face a double challenge on the cyber risk front – apart from the new risks that the mass transfer of employees working remotely...

Lark Technologies: Hyper Link Injection while signup

A hyperlink injection attack was reported on the Lark website. This flaw has since been remediated. We thank @susantwagle123 for reporting this to our team and confirming the resolution...

PT-2020-31: Denial of service in F5 Traffic Management Microkernel (TMM)

Traffic Management Microkernel TMM stops responding and restarts while a BIG-IP APM virtual server processes traffic of unknown character. Advisory status: 30.04.2020 - Vendor notification date 17.12.2020 - Security advisory publication date https://support.f5.com/csp/article/K51574311 Credits: T...

Automatic Instacart Bots

Instacart is taking legal action against bots that automatically place orders: Before it closed, to use Cartdash users first selected what items they want from Instacart as normal. Once that was done, they had to provide Cartdash with their Instacart email address, password, mobile number, tip...

GDPR.EU has er… a data leakage issue

GDPR.EU is an advice site ‘operated by Proton Technologies AG, co-funded by … the EU Horizon Framework’. It’s full of useful advice for organisations that need to comply with GDPR. Whilst it isn’t an official EU Commission site, it is partly funded by the EU. You may also be familiar with Proton...

Juplink Intelligent Technologies RX4-1500 Unauthorized Operation Vulnerability

The Juplink Intelligent Technologies RX4-1500 is a wireless router from Juplink Intelligent Technologies. A security vulnerability exists in httpd in the Juplink Intelligent Technologies RX4-1500 versions v1.0.3 through v1.0.5. A remote attacker could use this vulnerability to modify or access...

HCL Technologies Connections Information Disclosure Vulnerability

HCL Technologies Connections is a suite of enterprise collaboration platforms from HCL Technologies India. A security vulnerability exists in HCL Technologies Connections version 6.5, 6.0 and 5.5. The vulnerability can be exploited by an attacker to gain access to sensitive information...

Accelerator Program for Early-Stage Innovations in Water Update: Introducing our Innovators!

This Earth Day, we are excited to announce the first two grantees of Akamai's Accelerator Program for Early-Stage Innovations in Water: the Ashoka Trust for Research in Ecology and the Environment ATREE and the Foundation for Environmental Monitoring ffem. The Akamai Technologies India Corporate...

How to transform your revolutionary idea into a reality: $100K Nokia Bell Labs Prize

Revolutionary ideas in science, technology, engineering, and mathematics don't occur every day. But when those "eureka" moments happen, we need to provide a forum to explore those ideas, judge them on their merits, and distinguish the extraordinary from the merely good. Once a year, Nokia Bell La...

SuperBackup 2.0.5 for iOS - Persistent Cross-Site Scripting

Title: SuperBackup 2.0.5 for iOS - Persistent Cross-Site Scripting Author: Vulnerability Laboratory Date: 2020-04-15 Vendor: http://dropouts.in/ Software Link: https://apps.apple.com/us/app/super-backup-export-import/id1052684097 CVE: N/A Document Title: =============== SuperBackup v2.0.5 iOS - V...

SuperBackup 2.0.5 Persistent Cross Site Scripting

Document Title: =============== SuperBackup v2.0.5 iOS - VCF Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2202 Release Date: ============= 2020-04-15 Vulnerability Laboratory ID VL-ID: ====================================...

eten Technologies PSG-6528VM Cross-Site Scripting Vulnerability

The eten Technologies PSG-6528VM is a Gigabit PoE switch from eten Technologies of Taiwan, China. A cross-site scripting vulnerability exists in the eten Technologies PSG-6528VM version 1.1. The vulnerability stems from the lack of proper validation of client data by the WEB application. An...