1113 matches found
Announcing New Customer Support Portal and Unified Search
Qualys is rolling out new unified search and an improved online customer support experience, along with Support content integrated directly into Qualys Community. It's coming in January 2020. These new features are part of our efforts to enable customer success with an integrated community...
OpenBSD Local Privilege Escalation Vulnerability (CVE-2019-19726)
Qualys Research Labs discovered a local privilege escalation vulnerability in OpenBSD's dynamic loader. The vulnerability could allow local users or malicious software to gain full root privileges. OpenBSD developers have confirmed the vulnerability and released security patches in less than 3...
CVE-2019-11016: Open Redirect Vulnerability
Earlier this year the Qualys Web Application Scanning team discovered and reported an open redirect vulnerability CVE-2019-11016 in Elgg, an open source rapid development framework for socially aware web applications, which the Elgg team promptly fixed. Versions of the Elgg framework before 1.12....
December 2019 Patch Tuesday – 36 Vulns, 7 Critical, Actively Attacked Win32k vuln, Adobe vulns
This month's Patch Tuesday is rather light and addresses 36 vulnerabilities, with only 7 labeled as Critical. Five of the seven Critical vulns are in Git for Visual Studio. The others are for Hyper-V and Win32k. Also, there is one actively attacked "Important" vuln in Win32k. Adobe released patch...
OpenBSD Multiple Authentication Vulnerabilities
Multiple authentication vulnerabilities in OpenBSD have been disclosed by Qualys Research Labs. The vulnerabilities are assigned following CVEs: CVE-2019-19522, CVE-2019-19521, CVE-2019-19520, CVE-2019-19519. OpenBSD developers have confirmed the vulnerabilities and also provided a quick response...
Qualys Cloud Platform 2.42 New Features
This release of the Qualys Cloud Platform version 2.42 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning Additional XSS Payloads – A new option is available to have additional XSS payloads used in a standard vulnerability scan...
Streamlining and Automating Compliance
There are seemingly countless regulatory and industry frameworks out there that organizations have to navigate and comply with. SOX Sarbanes-Oxley, PCI-DSS Payment Card Industry Data Security Standard, GDPR General Data Protection Regulation, HIPAA Health Insurance Portability and Accountability...
Qualys Cloud Platform 8.22 New Features (VM, PC)
Update December 11, 2019: See additional details about this release. The 8.22.0 release adds several new features in Qualys Cloud Platform, adds a new API in Policy Compliance and support for 2 new technologies for OCA. Feature Highlights Qualys Cloud Platform Support for DNS tracking – You can n...
Policy Compliance Library Updates, November 2019
Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...
The Power and Future of the Qualys Cloud Platform
Qualys Security Conference 2019 kicked off this morning at the Bellagio hotel in Las Vegas. The event actually began on Monday with training sessions over the first two days, but this morning hundreds of attendees filled a conference room to listen to keynote presentations about the state of...
November 2019 Patch Tuesday – 74 vulns, 13 Critical, Actively Attacked IE vuln, Hyper-V escapes, Adobe
This month’s Microsoft Patch Tuesday addresses 74 vulnerabilities with 13 of them labeled as Critical. Of the 13 Critical vulns, 5 are for browsers and scripting engines. Out of the 8 remaining Critical vulns, 4 are potential hypervisor escapes in Hyper-V, as well as vulnerabilities in Microsoft...
Qualys Cloud Platform 8.21.7 New Features
Update November 27, 2019: The features referenced in this blog post will be released in Qualys Cloud Platform release 8.22. Update November 19, 2019: The features referenced in this blog post will be released in the next Qualys Cloud Platform release scheduled for December 2019, and will be...
BlueKeep Attacks Observed Months after Initial Release
The BlueKeep vulnerability, initially released in May 2019, is currently being exploited in the wild. Cybersecurity researchers have spotted initial attacks of Bluekeep RDP vulnerability. Here's a reminder about BlueKeep and instructions for using Qualys to identify attacks and remediate this...
Policy Compliance Library Updates, October 2019
Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...
Qualys Cloud Platform 8.21.6 New Features
Update Nov 19, 2019: This blog post was updated with additional detail about the new features in 8.21.6. The 8.21.6 release adds several new features in Qualys Cloud Platform, Policy Compliance, and Vulnerability Management. Apart from various other new features, this release adds support for App...
5 Reasons to Attend Qualys Security Conference 2019
Qualys is a leader in cybersecurity and one of the more recognizable and respected names in the industry. It should be. The company has been around for 20 years, and it continues to innovate and push the envelope. Later this month, Qualys will take over Bellagio Hotel in Las Vegas for the Qualys...
PHP Remote Code Execution Vulnerability (CVE-2019-11043)
Certain versions of PHP 7 running on NGINX with php-fpm enabled can be vulnerable to the remote code execution vulnerability CVE-2019-11043. Given the simplicity of the exploit, all web servers using the vulnerable version of PHP should be upgraded to non-vulnerable PHP versions as soon as...
New & Improved Qualys WAS Burp Extension Now Available
Last year we released the initial version of the Qualys WAS Burp extension to positive reviews. Customers welcomed the ability to send Burp-identified issues into Qualys Web Application Scanning WAS for centralized viewing and reporting of automated scanner findings plus manual pen-test issues fr...
Graboid: Revenge of the Worms
This week saw news of self-propagating worms in the container landscape to perform unsanctioned computation tasks such as cryptojacking. This blog post is intended for Qualys customers and partners to understand how such container attacks work, provide security best practice recommendations &...
Qualys Vulnerability Signature Release 2.4.722-4 Oracle DB New Feature
The release of the Qualys Vulnerability Signature, version 2.4.722-4, includes changes for Oracle Database signatures. The 2.4.722-4 release is live as of October 11, 2019. Feature Highlights Oracle Database Signatures 2019 With the 2.4.722-4 release, Qualys Vulnerability Management extends its...
October 2019 Patch Tuesday – 59 vulns, 9 Critical, Azure App Service, Remote Desktop Client, PoC for Windows Error Reporting
This month’s Microsoft Patch Tuesday addresses 59 vulnerabilities with only 9 of them labeled as Critical. Of the 9 Critical vulns, 7 of them are for browsers and scripting engines. The remaining 2 are for Azure App Service and Remote Desktop Client. In addition, PoC code has been published for a...
Enhanced API Scanning with Postman Support in Qualys WAS
Due to the fast-growing usage of REST APIs, having a way to test them for vulnerabilities in an automated, reliable way is more important than ever. Automated testing of APIs is a little trickier than for web applications. You can't simply enter a starting URL for the scanner and click "Go"...
Qualys Cloud Platform 2.41 New Features
This release of the Qualys Cloud Platform version 2.41 includes updates and new features for new Gov clouds in AssetView / CloudView and Web Application Scanning, highlights as follows. AssetView Microsoft Azure Gov Cloud Connector – Added connector support for Microsoft Azure Gov Clouds, includi...
Microsoft Released Out-of-Band Security Updates – How to Detect and Remediate
Microsoft released an out-of-band update yesterday that fixes two critical vulnerabilities - The Internet Explorer remote code execution vulnerability CVE-2019-1367 and Microsoft Defender Denial of Service Vulnerability CVE-2019-1255. According to the Microsoft advisory CVE-2019-1367, the Interne...
Empower your Cloud Ops Teams – Publish Qualys CloudView Security Assessment Reports to their Slack Channel
In today’s constantly changing and evolving cloud environments, being able to quickly provide information on misconfigurations and security policy violations in your cloud accounts and assets has become a critical need to the success of your security operations. Many cloud platforms offer tools...
Qualys Cloud Platform 8.21.2 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.21.2, includes Virtual Scanner Appliance support for Alibaba Cloud Compute, scheduling of EC2 scans with no scannable EC2 assets in Asset Tags in Qualys Vulnerability Management, expanded support for instance discovery and auto recor...
Assess Vulnerabilities, Misconfigurations in CI/CD Pipeline
After the publication of Golden AMI Pipeline integration with Qualys, some Qualys customers reached out asking how to integrate Qualys Vulnerability Management scanning into other types of CI/CD Pipelines. To answer these questions, we've published the new guide, Assess Vulnerabilities and...
Qualys Cloud Platform 8.21.2 New Features
The upcoming release of the Qualys Cloud Platform VM, PC, version 8.21.2, includes several new features in Qualys Cloud Platform and support for multiple technologies in Qualys Policy Compliance. The 8.21.2 release is scheduled to go live on 16th Sept, 2019. See full 8.21.2 new features blog post...
Patch Management 1.3 New Features
This release of Qualys Patch Management version 1.3 includes new features, highlights as follows. Patch Scheduling enhancement: "No Patch Window" – When scheduling a patch deployment, instead of having to specify a Patch Window time frame, you can select "None". This will allow a job to continue ...
Policy Compliance Library Updates, July 2019
Qualys' library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...
September Patch Tuesday – 79 Vulns, 17 Critical, Remote Desktop Client, SharePoint, Exploited PrivEsc
This month’s Microsoft Patch Tuesday addresses 79 vulnerabilities with 17 of them labeled as Critical. Of the 17 Critical vulns, 8 are for scripting engines and browsers, 4 are for the Remote Desktop Client, and 3 are for SharePoint. In addition, Microsoft has again patched a critical vulnerabili...
Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability – (CVE-2019-12643)
Cisco published an update for Cisco IOS XE operating system to patch a critical vulnerability that could allow a remote attacker to bypass authentication on devices running an outdated version of Cisco REST API virtual service container. The security issue is tracked as CVE-2019-12643 and has...
FedRAMP ConMon – Efficiently & Effectively Managing SLAs for RA-5d Requirement
Are you a FedRamp-certified organization looking to more effectively maintain your FedRAMP status? There are tools available to help simplify the process and while the process involves some terminology, it is easily understood as outlined below. Additionally, it is supported by pre-built dashboar...
Windows Remote Desktop Vulnerabilities (Seven Monkeys) – How to Detect and Patch
In the August 2019 Patch Tuesday release, Microsoft disclosed 7 RDP Vulnerabilities, out of which 4 are labeled as critical and 3 as important. All the critical vulnerabilities exist in Remote Desktop Services – formerly known as Terminal Services – and do not require authentication or user...
August 2019 Patch Tuesday – 93 Vulns, 29 Critical, 7 Remote Desktop Vulns, Hyper-V, DHCP, Adobe vulns
Update Aug 13, 2019: Detect and Patch Windows Remote Desktop Vulnerabilities This month’s Microsoft Patch Tuesday addresses 93 vulnerabilities with 29 of them labeled as Critical. Of the 29 Critical vulns, 10 are for scripting engines and browsers, 6 for Windows Graphics/Font Library, and 4 are f...
Qualys Cloud Platform 2.40 New Features
This release of the Qualys Cloud Platform version 2.40 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning "Everything" Detection Scope – A new detection scope called "Everything" is now available in the option profile. This can be used ...
Countdown to Black Hat: Top 10 Sessions to Attend — #9 and #10
With Black Hat USA 2019 now in progress, we wrap up this blog series with our final two session recommendations: Attacking and Defending the Microsoft Cloud and Practical Approach to Automate the Discovery and Eradication of Open-Source Software Vulnerabilities at Scale. Attacking and Defending t...
Qualys Cloud Platform (VM, PC) 8.21 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.21, adds new technologies and platforms, and support for scanning ESXi hosts on vCenter for vulnerabilities. Feature Highlights Qualys Vulnerability Management VM Support for Scanning ESXi Hosts on vCenter for Vulnerabilities – Qualy...
Countdown to Black Hat: Top 10 Sessions to Attend — #8
Black Hat kicks off in a few days, and for Qualys customers still planning their schedule we have our weekly recommendation from among the conference’s many training courses and research briefings: The Enemy Within: Modern Supply Chain Attacks. Speaker Eric Doerr, General Manager of the Microsoft...
Qualys Policy Compliance Notification: Policy Library Updates (June)
Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...
Countdown to Black Hat: Top 10 Sessions to Attend — #7
Black Hat USA 2019 is just weeks away, and with scores of training courses and research briefings to choose from, planning your schedule can be a challenge. To help you, we’re posting a weekly recommendation on our blog, and explaining why we think Qualys customers could find it useful and...
Countdown to Black Hat: Top 10 Sessions to Attend — #6
With Black Hat USA 2019 less than a month away, we continue our blog series with weekly recommendations of training courses and research briefings to attend at the conference. Our pick this week: the research briefing Controlled Chaos: The Inevitable Marriage of DevOps & Security. This 50-minute...
Qualys Policy Compliance Notification: Policy Library Updates (April, May)
Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...
Qualys Cloud Platform (VM, PC) 8.20.1 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.20.1, includes support for new technologies and platforms, addition of new technology for Windows UDCs as well as an update in an existing option name "Scan agent hosts in my target" in the Launch Vulnerability Scan page. Feature...
July 2019 Patch Tuesday – 77 Vulns, 15 Critical, DHCP RCE, Exploited PrivEsc, SQL, Adobe Vulns
This month’s Microsoft Patch Tuesday addresses 77 vulnerabilities with 15 of them labeled as Critical. Of the 15 Critical vulns, 11 are for scripting engines and browsers, with the remaining four covering DHCP Server, GDI+, .NET Framework, and Azure DevOps Server / Team Foundation Server. In...
Countdown to Black Hat: Top 10 Sessions to Attend — #5
Black Hat USA 2019, which is only one month away, offers scores of training courses and research briefings, so every week we’re picking a session we believe Qualys customers will find valuable. This week’s selection is the training course Adversary Tactics -- Detection. This course focuses on...
Video Training Update, July 2019
The Qualys Training team released a major update to the Vulnerability Management Certified Training Course. We’ve also built out two new video libraries showing how to assess business process risk and how to secure cloud infrastructures in DevSecOps environments using AWS Golden AMI pipelines. An...
Countdown to Black Hat: Top 10 Sessions to Attend — #4
With Black Hat USA 2019 fast approaching, we continue our blog series highlighting training sessions and research briefings that we think Qualys customers will find relevant and valuable. Our pick this week is the training session An Introduction To IoT Pentesting With Linux. The course offers “a...
Qualys Cloud Platform (VM, PC) 8.20 New Features
This new release of the Qualys Cloud Platform VM, PC, version 8.20, includes several new features in Qualys Cloud Platform and additional support for multiple technologies in Qualys Policy Compliance. Feature Highlights Qualys Cloud Platform Configure Password Expiration Notification – Now users...
Qualys Cloud Platform 2.39 New Features
This release of the Qualys Cloud Platform version 2.39 includes updates and new features for Out-of-Band Configuration Assessment OCA, Vulnerability Management, and Web Application Scanning, highlights as follows. Vulnerability Management Trending uses Include/Exclude Filters in Dashboard – Widge...