CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

Authentication flaw

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

CVE-2019-14511 affects Sphinx Technologies Sphinx up to version 3.1.1. By default, the service has no authentication and listens on 0.0.0.0, exposing it to the Internet unless firewall rules or a reconfiguration restrict it to 127.0.0.1. This creates reliance on network controls for exposure. Rel...

Surveillance as a Condition for Humanitarian Aid

Excellent op-ed on the growing trend to tie humanitarian aid to surveillance. Despite the best intentions, the decision to deploy technology like biometrics is built on a number of unproven assumptions, such as, technology solutions can fix deeply embedded political problems. And that auditing fo...

Frappe Technologies Frappe Framework SQL Injection Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A SQL injection vulnerability exists in Frappe Technologies Frappe Framework versions 10 through 12, which can be exploited by an attacker...

Customer Perspective: Catching the thief lurking in the shadows with EDR and MDR

A guest blog by Ian Loe, Senior Vice President, Cybersecurity, NTUC Enterprise Co-operative Limited News flash: aided by time, persistence and smarts, advanced cybersecurity felons are leapfrogging traditional security systems to compromise confidential data. Realising this, we at NTUC Enterprise...

CVE-2018-14383

The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7...

Design/Logic Flaw

The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7...

CVE-2018-14383

CVE-2018-14383 affects Transition Technologies “The Scheduler” app for Jira. The vulnerability is an XML External Entity (XXE) issue caused by a weakly configured/parameterized XML parser. Affected versions include 5.1.3, with fixes implemented in 5.2.1 (and 3.3.7 for Jira server installations). ...

CVE-2018-14383

The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7...

ForeScout Technologies: HTML Injection & Content Spoofing

Summary: The Main Search Box of the site "www.forescout.com" is Vulnerable for HTML Injection & Content Spoofing Steps To Reproduce: 1. Visit example link 2. in The Search Box enter HTML Code test 3. in the Result Page, the HTML code Will be render Impact 1. enter the Next Code In The Search Box...

Amcrest Technologies IP Camera Unauthenticated Remote Audio Streaming Vulnerability

The remote installation of Amcrest Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Critical Flaws in 'OXID eShop' Software Expose eCommerce Sites to Hacking

If your e-commerce website runs on the OXID eShop platform, you need to update it immediately to prevent your site from becoming compromised. Cybersecurity researchers have discovered a pair of critical vulnerabilities in OXID eShop e-commerce software that could allow unauthenticated attackers t...

Save the Date: 2019 CISA Cybersecurity Summit

The Cybersecurity and Infrastructure Security Agency CISA will be hosting the 2019 CISA Cybersecurity Summit from September 18-20, 2019, at National Harbor, MD. This summit will provide a forum for critical infrastructure stakeholders to discuss current cybersecurity topics, including emerging...

Lark Technologies: Server Side Request Forgery

It was found that one lark endpoint was susceptible to a Server-Side Request Forgery SSRF vulnerability using the parameter "URL" which could have potentially been used by an attacker to conduct host/port scanning on the internal network. We thank @jin0ne for reporting this to our team and...

Qualys Policy Compliance Notification: Policy Library Updates (June)

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

On the IoT road: perks, benefits and security of moving smartly

Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...

Redbrick Technologies Shift Information Disclosure Vulnerability (CNVD-2019-38844)

Redbrick Technologies Shift is a suite of application platforms from Redbrick Technologies, a Canadian company. The platform supports managed access to email, chat programs, network storage, and more. A security vulnerability exists in Redbrick Technologies Shift 3.4.3 and earlier versions. An...