Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Qualys Web Application Scanning researchers discovered and reported an open redirect vulnerability, CVE-2019-11016, in the Elgg framework, which the Elgg team promptly fixed. Versions before 1.12.18 and 2.3.x versions before 2.3.11 are vulnerable via the...
The JSOF research lab discovered Ripple20, a set of 19 vulnerabilities in the Treck TCP/IP stack used in embedded systems, affecting hundreds of devices or more. Four of the vulnerabilities - CVE-2020-11896, CVE-2020-11897, CVE-2020-11898, and...
Qualys describes integrating its security testing into CI/CD pipelines through plugins for Jenkins, Bamboo, and TeamCity, using the tools' plugin architecture to run dynamic security testing as a post-build action. The article walks through three pipeline...
F5 released updates for CVE-2020-5902, a critical remote code execution flaw in BIG-IP products rated 9.8 on CVSS v3.1 that allows attackers to read files, execute code, or take complete control of vulnerable systems with network access. The vulnerability,...
On September 11, 2020, a Dutch team known as Secura published an exploit showing how an unauthenticated remote user can take control of a domain controller and gain admin privileges through CVE-2020-1472, which received the maximum CVSS v3 score of 10.0....
HTTP Request Smuggling lets an attacker hide a second request inside the body of a first by exploiting the HTTP specification's two ways to signal a request's end: the Content-Length header or the Transfer-Encoding: chunked header. Qualys Web Application...
Adobe announced in July 2017 that Flash Player would reach end of life on December 31, 2020, after which Adobe will no longer support or distribute it and will issue no further security patches. Adobe plans to block Flash content from running in Flash...
Attackers compromised SolarWinds' software development and delivery pipeline and inserted malicious code into the SolarWinds.Orion.BusinessLayer.dll driver, which was then digitally signed and downloaded by thousands of users. The malware runs as an HTTP...
Qualys introduced an asset merging capability in its Cloud Platform that combines unauthenticated scan results with Qualys Cloud Agent collections for the same asset, giving a single record that includes the attacker's point of view. The feature, fully...
The Qualys Research Team discovered a heap overflow vulnerability in sudo, tracked as CVE-2021-3156, that lets any unprivileged user gain root privileges on a vulnerable host using a default configuration. The flaw was introduced in July 2011 (commit...
Qualys describes its SSPM product, built on its FedRAMP-authorized Cloud Platform, as a single console for continuous visibility, data access control, and security configuration hygiene across Microsoft Office 365, Zoom, Salesforce, and Google Workspace,...
Following FedRAMP's release of Vulnerability Scanning Requirements for Containers, FedRAMP-authorized systems using containers had one month from March 16, 2021 to submit a compliance plan. FedRAMP defines five core requirements for Cloud Service Providers...
Qualys introduced Out-of-Band Configuration Assessment for mainframes, which uses an offline data-push mechanism rather than connecting directly to the systems or installing a Cloud Agent. Customers run prescribed commands such as 'SETROPTS LIST' for IBM...
Qualys reported that a threat actor exploited a zero-day vulnerability in its third-party Accellion FTA file-transfer appliance, which it had patched on December 22, 2020, and isolated after an integrity alert on December 24, 2020. Qualys said forensic...
Nefilim ransomware emerged in March 2020 when Nemty operators left the ransomware-as-a-service model for more targeted attacks, and the new family appears based on Nemty's code, sharing similarities with Nemty version 2.5. It gains initial access through...
DarkSide ransomware, first seen in August 2020 and updated to v2.0 in March 2021, targets large, high-revenue organizations to encrypt and steal sensitive data, operating as ransomware-as-a-service with double extortion. It gains initial access through...
On June 29, 2021, a zero-day exploit was observed on Microsoft Windows systems that lets an authenticated user with a regular Domain User account gain full SYSTEM-level privileges, and Microsoft linked it to CVE-2021-34527 as a confirmed remote code...
On July 2, 2021, Kaseya announced its software had been compromised and was being used to attack customer IT infrastructure, with REvil operators exploiting zero-day CVE-2021-30116 in the VSA product to deploy ransomware. REvil, a ransomware-as-a-service...
Qualys published Part 3 of its API Best Practices series, combining the Host List, KnowledgeBase, and Host List Detection APIs to build a timestamped point-in-time SQLite database of vulnerability data. The post provides an open-source Python blueprint...
Qualys researchers found a size_t-to-int type conversion flaw in the Linux kernel's seq_file interface, tracked as CVE-2021-33909, that lets any unprivileged user gain root on a vulnerable host in a default configuration. Qualys verified an exploit and...
Pegasus is surveillance software built by Israeli cyber intelligence firm NSO Group, first detected in 2016 using spear-phishing and now infecting devices through zero-click attacks that exploit OS, iMessage, and WhatsApp vulnerabilities, including...
A vulnerability tracked as CVE-2020-17530 in the OGNL evaluation function of Apache Struts versions 2.0.0 through 2.5.25 allows attackers to achieve remote code execution through double evaluation of tag attributes when an application is configured to...
Apache Tomcat versions 10.0.0-M1 through 10.0.6, 9.0.0.M1 through 9.0.46, and 8.5.0 through 8.5.66 incorrectly parse the HTTP transfer-encoding request header in some circumstances, creating the possibility of HTTP Request Smuggling when Tomcat sits behind...
On October 4, 2021, the Apache HTTP Server Project issued an advisory for CVE-2021-41773, a path traversal and file disclosure flaw in versions 2.4.49 and 2.4.50 that Apache said was known to be exploited in the wild, and research later showed it could be...
An exploit for a critical zero-day in Apache Log4j2, named Log4Shell, was disclosed on December 9, 2021, affecting all versions from 2.0-beta9 through 2.15.0 and allowing remote code execution with system-level privileges, rated CVSS 10.0. Apache fixed it...
Qualys released an out-of-band Linux script and Windows utility that perform a deep file scan to find every instance of a vulnerable Log4j library, regardless of how the Java application was coded, packaged, or deployed. Qualys says its QID detection logic...
Qualys outlines six detection opportunities for Log4Shell (CVE-2021-44228 and CVE-2021-45046), an input-validation flaw in Log4j2 that lets attackers use JNDI lookups to reach LDAP, RMI, CORBA and DNS services and run arbitrary code remotely. The post...
Qualys added two pre-configured option profiles to its library for detecting Log4Shell: Log4Shell – Authenticated Scan and Log4Shell – Unauthenticated Scan, both importable via Scans > Option Profiles > New and tuned to quickly detect the vulnerability....
Qualys CyberSecurity Asset Management now natively integrates with Shodan, letting teams pull internet-visible assets matching filters such as organization name, domain, or certificate name and compare them against the existing Qualys inventory. CSAM tags...
Qualys describes how its Container Security sensor detects Log4Shell in running containers by scanning each container on a host for a running Java process, then checking whether that process has the log4j jar loaded and reporting the version if vulnerable....