Policy Compliance Library Updates, July 2019

Qualys' library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

September 10, 2019—KB4515384 (OS Build 18362.356)

None None...

Akamai and Exceda - Maximizing Customer and Partner Value in Latin America Together

Today, Akamai announced an agreement to acquire Exceda, our largest channel partner in Latin America. I want to share what this acquisition means for our customers and partners, and why I am so excited about the potential that this represents for us all. Initially becoming a channel partner in...

CVE-2019-13656

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code...

Code injection

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code...

CVE-2019-13656

CVE-2019-13656 affects CA Technologies Client Automation components: CA Common Services DIA in CA Technologies Client Automation 14 and Workload Automation AE 11.3.5/11.3.6. Multiple sources (NVD/Red Hat/CNVD) describe an access control error that enables a remote attacker to execute arbitrary co...

PT-2019-13464

Name of the Vulnerable Software and Affected Versions CA Technologies Client Automation version 14 CA Workload Automation AE versions 11.3.5 through 11.3.6 Description An access issue in CA Common Services DIA allows a remote attacker to execute arbitrary code. Recommendations For CA Technologies...

CVE-2019-13656: Improper Access Control

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code...

lodash CVE-2019-1010266 Denial of Service Vulnerability

Description lodash is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial-of-service condition. lodash versions prior to 4.17.11 are vulnerable. Technologies Affected Cisco Application Policy Infrastructure Controller APIC IBM Cloud Private 3.2.0 CD IBM...

Metasploit HTTP(S) handler DoS

This module exploits the Metasploit HTTPS handler by sending a specially crafted HTTP request that gets added as a resource handler. Resources which come from the external connections are evaluated as RegEx in the handler server. Specially crafted input can trigger Gentle, Soft and Hard DoS. Test...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

Authentication flaw

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only...

CVE-2019-14511

CVE-2019-14511 affects Sphinx Technologies Sphinx up to version 3.1.1. By default, the service has no authentication and listens on 0.0.0.0, exposing it to the Internet unless firewall rules or a reconfiguration restrict it to 127.0.0.1. This creates reliance on network controls for exposure. Rel...

Surveillance as a Condition for Humanitarian Aid

Excellent op-ed on the growing trend to tie humanitarian aid to surveillance. Despite the best intentions, the decision to deploy technology like biometrics is built on a number of unproven assumptions, such as, technology solutions can fix deeply embedded political problems. And that auditing fo...

Frappe Technologies Frappe Framework SQL Injection Vulnerability

Frappe Technologies Frappe Framework is a metadata-driven full-stack web application framework based on Python and JavaScript from Frappe Technologies, India. A SQL injection vulnerability exists in Frappe Technologies Frappe Framework versions 10 through 12, which can be exploited by an attacker...

Customer Perspective: Catching the thief lurking in the shadows with EDR and MDR

A guest blog by Ian Loe, Senior Vice President, Cybersecurity, NTUC Enterprise Co-operative Limited News flash: aided by time, persistence and smarts, advanced cybersecurity felons are leapfrogging traditional security systems to compromise confidential data. Realising this, we at NTUC Enterprise...