Qualys Community

1054 posts

Handling Cross-Site Scripting As Attacks Get More Sophisticated

Adopting third-party libraries to encode user input in the development phase and using a web application firewall in the deployment phase could fool web security managers into thinking their web applications are completely safe from Cross-Site Scripting (XSS) attacks. While it’s a good idea to employ these techniques, the illusion of safety could prove costly. These protection methods do not guarantee that your web applications are 100% free of XSS vulnerabilities, and XSS attacks that use more sophisticated techniques still occur, so care should still be taken.

Continue reading …

Oracle July 2016 Critical Patch Update

Today Oracle released its July critical patch update fixing 276 security issues across hundreds of Oracle products. On average in 2015 Oracle fixed about 161 vulnerabilities per update and the number was 128 in 2014. That makes today’s update the largest and here is a breakdown of the vulnerabilities. Out of the 276 vulnerabilities, 159 can be exploited remotely without authentication, typically over a network without the need of any credentials. The table lists components ordered by the number of issues and description below has details. Since most organizations have different teams to patch databases, networking components, operating systems, applications server and ERP systems, I have broken down the massive update in these categories.

Continue reading …

CGI application vulnerability httpoxy for PHP, Go, Python and others


A CGI application vulnerability called httpoxy was announced today with coordinated disclosure from many vendors. The vulnerability allows an attacker to remotely set the HTTP_PROXY environment variable on affected servers which can lead to a number of bad consequences.

Continue reading …

Patch Tuesday July 2016: Microsoft and Adobe

Its July 2016 patch Tuesday and Microsoft has released 11 security updates that affect a host of desktop and server systems. Six updates are categorized as Critical while the rest are categorized as Important.

Most of the critical updates released today affect desktop systems. Top priority should be given to fixing browsers and Office which includes MS16-084 that affects Internet Explorer, MS16-085 which affects Microsoft Edge and MS16-088 for Office. All three updates fix vulnerabilities that allow an attacker to take complete control of the victim’s machine and therefore these should be patched immediately.

Continue reading …

Are Your Vendors, Partners and Other Business Allies Putting Your Organization at Risk?

Qualys SAQ Automates the Process of Assessing Your Third Parties’ Security Posture

How compliant are vendors and other third parties with information security standards, your organization’s internal policies and government regulations? Making these assessments has never been easy, but it’s getting increasingly complicated, and the stakes are getting higher. While your organization may have gone to great lengths to secure its IT infrastructure, networks and assets, the vendors and other third parties with remote access to your systems and data can make you vulnerable to breaches.

Continue reading …

Qualys Supports New Cisco Threat-Centric NAC

Integrated Vulnerability Data Dynamically Alters User Permissions Based on the Fluctuating Threat Ratings of a Device

The onslaught of new devices and applications in the enterprise has clouded visibility into who and what is connecting to the network. This raises increased security concerns, since more devices mean more potential ways to compromise the network. Enterprises have generally responded to these concerns by continually adding security systems from multiple vendors to their networks.

Continue reading …

New Qualys App for Splunk Enterprise Adds Real-time Dashboard and Analytics for Web Application Scanning

The newly released Qualys Web Application Scanning (WAS) App for Splunk Enterprise delivers information about affected web applications and prevalent vulnerabilities into the Splunk dashboard, and enables preconfigured searches and reports, for customers using both Qualys and Splunk. Just like with Qualys WAS, this new app also helps you analyze consistent WAS data across application lifecycles, detect unauthorized apps and rapidly harden your web apps with Qualys Web Application Firewall (WAF).

Continue reading …

New Release of SSL/TLS Deployment Best Practices

This month I released an updated version of SSL/TLS Deployment Best practices—my favourite SSL Labs publication—bringing the document up to date again. Given that the previous release was a long time ago (December 2014!), this version has quite a few changes and improvements.

Continue reading …

Qualys Cloud Suite 8.8 New Features

A new release of the Qualys Cloud Suite, version 8.8, is targeted for release in July and includes updates for usability and functionality across the platform as well as Vulnerability Management and Policy Compliance.

Cloud Platform: Asset Search has been improved making it easier to find, report and take actions on assets via the Asset Search Report. Several improvements to enforce security levels for Windows authentication were added, along with new options for scanner replacement, IPv6 Configuration, and stored data retention.

Vulnerability Management: Several exciting new features are available in VM in this release including CVSS version 3 and the ability to close vulnerabilities for “dead hosts” following a scan. Additional attributes are now available when downloading KnowledgeBase and in Vulnerability Notifications.

Policy Compliance: We are continuing the expansion of application technology assessment with the addition of Oracle WebLogic, IBM HTTP Server 8, IBM WebSphere 8, and assessment for Checkpoint Firewall. Improvements have been made to Exception Management, and it’s now easier to associate Cloud Agent assets with Policies. We’ve also included several improvements to the User Defined Controls and released the new Windows Group Membership UDC.

Continue reading …