Blog - Page 248 of 933 - Dr. Ware Technology Services

Get started with minimal API for .NET 6

by Contributed | Nov 8, 2021 | Technology

This article is contributed. See the original author and article here.

TLDR; Using minimal API, you can create a Web API in just 4 lines of code by leveraging new features like top-level statements and more.

Why Minimal API

There are many reasons for wanting to create an API in a few lines of code:

Create a prototype. Sometimes you want a quick result, a prototype, something to discuss with your colleagues. Having something up and running quickly enables you to quickly do changes to it until you get what you want.

Progressive enhancement. You might not want all the “bells and whistles” to start with but you may need them over time. Minimal API makes it easy to gradually add what you need, when you need it.

How is it different from a normal Web API?

There are a few differences:

Less files. Startup.cs isn’t there anymore, only Program.cs remains.

Top level statements and implicit global usings. Because it’s using top level statements, using and namespace are gone as well, so this code:

 using System;
   namespace Application
   {
        class Program
        {
            static void Main(string[] args)
            {
                Console.WriteLine("Hello World!");
            }
        }
   }

is now this code:

 Console.WriteLine("Hello World!");

Routes Your routes aren’t mapped to controller classes but rather setup with a Map[VERB] function, like you see above with MapGet() which takes a route and a function to invoke when said route is hit.

Your first API

To get started with minimal API, you need to make sure that .NET 6 is installed and then you can scaffold an API via the command line, like so:

dotnet new web -o MyApi -f net6.0

Once you run that, you get a folder MyApi with your API in it.

What you get is the following code in Program.cs:

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

app.MapGet("/", () => "Hello World!");

app.Run();

To run it, type dotnet run. A little difference here with the port is that it assumes random ports in a range rather than 5000/5001 that you may be used to. You can however configure the ports as needed. Learn more on this docs page

Explaining the parts

Ok so you have a minimal API, what’s going on with the code?

Creating a builder

var builder = WebApplication.CreateBuilder(args);

On the first line you create a builder instance. builder has a Services property on it, so you can add capabilities on it like Swagger Cors, Entity Framework and more. Here’s an example where you set up Swagger capabilities (this needs install of the Swashbuckle NuGet to work though):

builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen(c =>
    {
        c.SwaggerDoc("v1", new OpenApiInfo { Title = "Todo API", Description = "Keep track of your tasks", Version = "v1" });
    });

Creating the app instance

Here’s the next line:

var app = builder.Build();

Here we create an app instance. Via the app instance, we can do things like:

Starting the app, app.Run()

Configuring routes, app.MapGet()

Configure middleware, app.UseSwagger()

Defining the routes

With the following code, a route and route handler is configured:

app.MapGet("/", () => "Hello World!");

The method MapGet() sets up a new route and takes the route “/” and a route handler, a function as the second argument () => “Hello World!”.

Starting the app

To start the app, and have it serve requests, the last thing you do is call Run() on the app instance like so:

app.Run();

Add routes

To add an additional route, we can type like so:

public record Pizza(int Id, string Name); 
app.MapGet("/pizza", () => new Pizza(1, "Margherita"));

Now you have code that looks like so:

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

app.MapGet("/pizza", () => new Pizza(1, "Margherita"));
app.MapGet("/", () => "Hello World!");

public record Pizza(int Id, string Name); 

app.Run();

Where you to run this code, with dotnet run and navigate to /pizza you would get a JSON response:

{
  "pizza" : {
    "id" : 1,
    "name" : "Margherita"
  }
}

Example app

Let’s take all our learnings so far and put that into an app that supports GET and POST and lets also show easily you can use query parameters:

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

var pizzas = new List<Pizza>(){
   new Pizza(1, "Margherita"),
   new Pizza(2, "Al Tonno"),
   new Pizza(3, "Pineapple"),
   new Pizza(4, "Meat meat meat")
};

app.MapGet("/", () => "Hello World!");
app.MapGet("/pizzas/{id}", (int id) => pizzas.SingleOrDefault(pizzas => pizzas.Id == id));
app.MapGet("/pizzas", (int ? page, int ? pageSize) => {
    if(page.HasValue && pageSize.HasValue) 
    {
        return pizzas.Skip((page.Value -1) * pageSize.Value).Take(pageSize.Value);
    } else {
        return pizzas;
    }
});
app.MapPost("/pizza", (Pizza pizza) => pizzas.Add(pizza));

app.Run();

public record Pizza(int Id, string Name);

Run this app with dotnet run

In your browser, try various things like:

“http://localhost:{PORT}/pizzas“, should give you all pizzas back

“http://localhost:{PORT}/pizzas?page=1&pageSize=2“, should give you the two first pizzas. See how the query parameters are working for you.

“http://localhost:{PORT}/pizzas/2“, should give you the “Al Tonno” pizza back. Here you have the {id} matching the 2 and thereby it filters down on the one item that matches.

Learn more

Check out these LEARN modules on learning to use minimal API

Your first minimal API + Swagger

minimal API with Entity Framework

minimal API with React

Revolutionizing the future for sellers in Dynamics 365 Sales

by Contributed | Nov 8, 2021 | Dynamics 365, Microsoft 365, Technology

This article is contributed. See the original author and article here.

Where and how we work has changed. The hybrid work environment is here to stay, and with it, comes a new set of demands on our sales organizations. The tools that sellers are currently using are not helping meet these new demands.

Yesterday’s tools don’t serve our modern objectives. Sellers can’t afford to work in siloed systems and manually enter data at the end of the day. Manual tracking contributes to poor data quality and prevents sellers from connecting well with customers.

To help our customers thrive in this new normalwe have to break down the silos that not only exist between applications but also those that exist between people across the department, the company, and externally with customers and partners. We need to blur the lines between business applications, productivity tools, and collaboration capabilities so we can help our customers drive efficient and effective customer engagements. Sellers demand this, and their customers expect it.

Microsoft Dynamics 365 represents the new era of business apps that start from data, use AI, and are built for collaboration.

Given all of this, how does that change what’s top of mind for us as we build and refine our Dynamics 365 Sales app? Our approach is to deliver data first, intelligent, and collaborative business applications. The Dynamics 365 Sales 2021 release wave 2 enhancements can be broken down into three focus areas:

Conversational intelligence to be more effective in closing dealsEnsuring we support users with valuable, productive experiences that ultimately delight the customer.
Collaborate anywhere and everywhere to bring deal teams togetherGet better connected across the team with interactions that surface context, and enable easy action and history capture wherever they work.
Personal productivity to be more efficient and effectiveSave time with prioritization, preparation, and tracking, taken care of for you whether in the office or on the go.

Conversational intelligence to be more effective in closing deals

With the enhancements made with conversational intelligence, sellers can now focus on effectively responding to buying signals to maximize that customer moment. No more selling regrets post-call by missing a trigger. For instance, as sellers prepare for calls, they can quickly review a summary of the previous call, action items, and scan highlights. Using Microsoft Teams within Dynamics 365, sellers can easily make their calls while having access to business data and take notes while the call is being transcribed automatically. Any business-critical insight mentioned during the call is captured and highlighted and suggested actions are surfaced. With all these tips, this approach is so much more effective than having this conversation over Teams aloneeven more effective than doing it face to face. Sellers can now focus on responding to buying signals to maximize that customer moment. No more missing a follow-up or forgetting a customer promise.

Call summaries with suggested actions

See this demo in action: KEY05 Microsoft Ignite Into Focus: Business Applications [approx. min 15:00]

Collaborate anywhere and everywhere to bring deal teams together

With our hybrid work styles, the lines between business productivity and general productivity are forever erased. Business users are using Microsoft Office, Teams, mobile applications, and customer relationship management (CRM) applications. Selling is messy. As much as we’d like it to, it doesn’t follow a linear process. Many different people need to be involved and it’s a changing environment as new requirements are surfaced or people change roles, or new questions come up. At Microsoft Ignite 2021, we announced “Context IQ” a new set of capabilities for Dynamics 365 and Microsoft 365 that enable better collaboration by surfacing information and people in the moment, in context with the task at hand. We will vastly improve the ability for a seller to get a job done with others, retain context before, during, and afterward, no matter what application you are in.

Collaborating with team members from within Dynamics 365

Learn more: BRK203 – Accelerate cross-organization collaboration with Dynamics 365 and Microsoft 365

Personal productivity to be more efficient and effective

The more data-driven sellers are, the more opportunities they have to work on the right priority deals to close. And who wouldn’t want to remove time spent on data entry and instead focus that time on being more effective in customer interactions? In Dynamics 365 Sales, work items are prioritized based on AI so sellers know what action to take and when. Contact information captured through emails and meetings in Outlook is directly brought into Dynamics 365 Sales, helping sellers to instantly discover new contacts and expand their networks. And so you don’t skip a beat when you’re on the go, you can keep track of everything using the built-in Outlook and Teams integration in the intuitive mobile-friendly UI that allows you to follow up on action items and to update records while being away from your computer. All of this is rolled into seller KPI and manager dashboards that help your sales teams be more data-driven with their decision-making to drive better outcomes.

We have been on an incredible journey with our customershelping them evolve their business applications from systems of record capturing data, to intelligent applications that use data and collaboration to drive action. I am incredibly excited to continue this journey as we blur the lines between business application, collaboration, and productivity tools so that we can empower each user with what they need and where they need it so they can achieve better business outcomes.

Resources and links

Learn more about what’s included in Dynamics 365 2021 release wave 2 for Dynamics 365 Sales.

Missed a session at Microsoft Ignite? Watch it on-demand. Dynamics 365 Sales is highlighted in the following sessions:

To learn more about how your organization can supercharge your digital sellers, visit the Dynamics 365 Sales webpage and sign up for a free trial.

The post Revolutionizing the future for sellers in Dynamics 365 Sales appeared first on Microsoft Dynamics 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

It’s National Family Caregivers Month

by Scott Muniz | Nov 8, 2021 | Security

This article was originally posted by the FTC. See the original article here.

Family caregivers are the biggest source of support for older adults and people with disabilities in the U.S. If you’re one of the busy people who prepares meals, drives to medical appointments, helps pay bills, and visits someone regularly, you’ve seen the tremendous difference your contributions make in their life. You may also have warned them about the scams that may come through their phone, email, or mailbox. We know it takes a lot to be a caregiver, and during National Family Caregiver’s Month, we’ll publish a series of blogs to share resources and suggestions that could make your days a bit easier.

First, we’ll explain how to avoid and stop the unwanted calls that seem to come when you’re waiting for an important call, or sitting down to relax. Then, we’ll share advice about claims to watch out for if you’re interested in a dietary supplement and how to spot false or misleading ads for treatments. Finally, because many caregivers are interested in work with flexible schedules, we’ll show some warning signs of scam job ads for mystery shoppers, personal assistants, re-shipping clerks, and other jobs. We’ll tell you how to spot and avoid the scammers that are after your money and personal information.

Find more articles about common scams that affect older adults, including home repair scams, identity theft, and calls from fake “grandchildren” at Pass It On. If you spot a scam, or consumer problem, please tell the FTC at ReportFraud.ftc.gov.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Vulnerability Summary for the Week of November 1, 2021

by Scott Muniz | Nov 8, 2021 | Security, Technology

This article is contributed. See the original author and article here.

android — samsung Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key without limitation. 2021-11-05 not yet calculated CVE-2021-25508
MISC android — samsung An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted application to call some protected providers. 2021-11-05 not yet calculated CVE-2021-25501
MISC android — samsung AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php. 2021-11-01 not yet calculated CVE-2021-25877
MISC
MISC
MISC android — samsung A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge. 2021-11-05 not yet calculated CVE-2021-25502
MISC android — samsung Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information. 2021-11-05 not yet calculated CVE-2021-25504
MISC android — samsung
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators’ session cookies or perform actions as an administrator. 2021-11-01 not yet calculated CVE-2021-25876
MISC
MISC
MISC android — samsung
A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe. 2021-11-05 not yet calculated CVE-2021-26844
MISC
MISC android — samsung
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators’ session cookies or perform actions as an administrator. 2021-11-01 not yet calculated CVE-2021-25878
MISC
MISC
MISC android — samsung
A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise. 2021-11-05 not yet calculated CVE-2021-25500
MISC android — samsung
Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution. 2021-11-05 not yet calculated CVE-2021-25503
MISC android — samsung
Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. 2021-11-05 not yet calculated CVE-2021-25505
MISC android — samsung
Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service. 2021-11-05 not yet calculated CVE-2021-25506
MISC android — samsung
Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with user device to access part of notification data in Secure Folder without authorization. 2021-11-05 not yet calculated CVE-2021-25507
MISC android — samsung
A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Windows known folders. 2021-11-05 not yet calculated CVE-2021-25509
MISC android — samsung
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes. 2021-11-01 not yet calculated CVE-2021-25874
MISC
MISC
MISC android — samsung
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators’ session cookies or perform actions as an administrator. 2021-11-01 not yet calculated CVE-2021-25875
MISC
MISC
MISC ayacms — ayacms
Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified impacts. 2021-11-02 not yet calculated CVE-2020-23686
MISC azeotech — daqfactory An attacker could prepare a specially crafted project file that, if opened, would attempt to connect to the cloud and trigger a man in the middle (MiTM) attack. This could allow an attacker to obtain credentials and take over the user’s cloud account. 2021-11-05 not yet calculated CVE-2021-42701
MISC azeotech — daqfactory
The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown. 2021-11-05 not yet calculated CVE-2021-42543
MISC azeotech — daqfactory
Project files are stored memory objects in the form of binary serialized data that can later be read and deserialized again to instantiate the original objects in memory. Malicious manipulation of these files may allow an attacker to corrupt memory. 2021-11-05 not yet calculated CVE-2021-42698
MISC azeotech — daqfactory
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account. 2021-11-05 not yet calculated CVE-2021-42699
MISC bluez — bluez
An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call. 2021-11-04 not yet calculated CVE-2021-43400
MISC bookstack — bookstack
bookstack is vulnerable to Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 2021-11-05 not yet calculated CVE-2021-3916
CONFIRM
MISC cisco — asyncos
A vulnerability in the email scanning algorithm of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation of incoming emails. An attacker could exploit this vulnerability by sending a crafted email through Cisco ESA. A successful exploit could allow the attacker to exhaust all the available CPU resources on an affected device for an extended period of time, preventing other emails from being processed and resulting in a DoS condition. 2021-11-04 not yet calculated CVE-2021-34741
CISCO cisco — multiple_products
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an unauthenticated, remote attacker to render the web-based management interface unusable, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to cause a permanent invalid redirect for requests sent to the web-based management interface of the device, resulting in a DoS condition. 2021-11-04 not yet calculated CVE-2021-40127
CISCO cisco — policy_suite
A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system as the root user. This vulnerability is due to the re-use of static SSH keys across installations. An attacker could exploit this vulnerability by extracting a key from a system under their control. A successful exploit could allow the attacker to log in to an affected system as the root user. 2021-11-04 not yet calculated CVE-2021-40119
CISCO cisco — small_business_series_switches
A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device. This vulnerability is due to insufficient expiration of session credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack against an affected device to intercept valid session credentials and then replaying the intercepted credentials toward the same device at a later time. A successful exploit could allow the attacker to access the web-based management interface with administrator privileges. 2021-11-04 not yet calculated CVE-2021-34739
CISCO couchbase — server
Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request from the pluggable UI (query workbench etc) to the specific service. In the backtrace, the Basic Auth Header included in the HTTP request, has the “@” user credentials of the node processing the UI request. 2021-11-02 not yet calculated CVE-2021-42763
MISC
MISC couchbase — server
metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key tombstone purging was added in Couchbase Server 7.0.0. This issue happens when a config key, which is being logged, has a tombstone purger time-stamp attached to it. 2021-11-02 not yet calculated CVE-2021-37842
MISC
MISC crypto++ — crypto++
Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. 2021-11-04 not yet calculated CVE-2021-43398
MISC
MISC d-link — dir-823g_devices
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the PrivateLogin field to Login. 2021-11-04 not yet calculated CVE-2020-25368
MISC
MISC
MISC fusionpbx — fusionpbx
An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values). 2021-11-05 not yet calculated CVE-2021-43406
MISC fusionpbx — fusionpbx
An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters. 2021-11-05 not yet calculated CVE-2021-43404
MISC fusionpbx — fusionpbx
An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric). 2021-11-05 not yet calculated CVE-2021-43405
MISC gitlab — ce/ee In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from. 2021-11-05 not yet calculated CVE-2021-39898
MISC
CONFIRM
MISC gitlab — ce/ee In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a project to a restricted option even after the instance administrator sets that visibility option as restricted in settings. 2021-11-04 not yet calculated CVE-2021-39903
MISC
CONFIRM
MISC gitlab — ce/ee Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim’s behalf. 2021-11-05 not yet calculated CVE-2021-39906
MISC
CONFIRM
MISC gitlab — ce/ee A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7. The stripping of EXIF data from certain images resulted in high CPU usage. 2021-11-05 not yet calculated CVE-2021-39907
MISC
CONFIRM
MISC gitlab — ce/ee An improper access control flaw in GitLab CE/EE since version 13.9 exposes private email address of Issue and Merge Requests assignee to Webhook data consumers 2021-11-05 not yet calculated CVE-2021-39911
MISC
CONFIRM gitlab — ce/ee A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user 2021-11-04 not yet calculated CVE-2021-39914
MISC
CONFIRM gitlab — ce/ee
In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unsuspecting owner imports that project, pipelines are active by default on that project. Under specialized conditions, this may lead to information disclosure if the project is imported from an untrusted source. 2021-11-05 not yet calculated CVE-2021-39895
MISC
CONFIRM
MISC gitlab — ce/ee
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred 2021-11-05 not yet calculated CVE-2021-39897
MISC
CONFIRM
MISC gitlab — ce/ee
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoint. 2021-11-05 not yet calculated CVE-2021-39901
MISC
CONFIRM
MISC gitlab — ce/ee
An Improper Access Control vulnerability in the GraphQL API in GitLab CE/EE since version 13.1 allows a Merge Request creator to resolve discussions and apply suggestions after a project owner has locked the Merge Request 2021-11-05 not yet calculated CVE-2021-39904
CONFIRM
MISC
MISC gitlab — ce/ee
A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7. Using a malformed TIFF images was possible to trigger memory exhaustion. 2021-11-05 not yet calculated CVE-2021-39912
CONFIRM
MISC
MISC gitlab — ce/ee
Accidental logging of system root password in the migration log in all versions of GitLab CE/EE allows an attacker with local file system access to obtain system root-level privileges 2021-11-05 not yet calculated CVE-2021-39913
CONFIRM
MISC gitlab — ce/ee
Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. 2021-11-04 not yet calculated CVE-2021-39902
MISC
MISC
CONFIRM gitlab — ce/ee
An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groups that a public project has been shared with 2021-11-05 not yet calculated CVE-2021-39905
MISC
CONFIRM
MISC gitlab — ee/ee
Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE since version 11.3 allows an attacker to bypass CODEOWNERS Merge Request approval requirement under rare circumstances 2021-11-05 not yet calculated CVE-2021-39909
MISC
MISC
CONFIRM gnu_library — glibc
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious ” character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. 2021-11-04 not yet calculated CVE-2021-43396
MISC graphiql — graphiql
GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than graphiql@1.4.7 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a vulnerable schema in graphiql. There are a number of ways that can occur. By default, the schema URL is not attacker-controllable in graphiql or in its suggested implementations or examples, leaving only very complex attack vectors. If a custom implementation of graphiql’s fetcher allows the schema URL to be set dynamically, such as a URL query parameter like ?endpoint= in graphql-playground, or a database provided value, then this custom graphiql implementation is vulnerable to phishing attacks, and thus much more readily available, low or no privelege level xss attacks. The URLs could look like any generic looking graphql schema URL. It should be noted that desktop clients such as Altair, Insomnia, Postwoman, do not appear to be impacted by this. This vulnerability does not impact codemirror-graphql, monaco-graphql or other dependents, as it exists in onHasCompletion.ts in graphiql. It does impact all forks of graphiql, and every released version of graphiql. 2021-11-04 not yet calculated CVE-2021-41248
MISC
CONFIRM
MISC graphiql — graphql_plyground
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user’s browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later. 2021-11-04 not yet calculated CVE-2021-41249
CONFIRM
MISC
MISC grav — grav grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 2021-11-05 not yet calculated CVE-2021-3924
CONFIRM
MISC hewlett_packard — pagewide_and_officejet
HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution. 2021-11-03 not yet calculated CVE-2020-28416
MISC ibm — business_automation_workflo
IBM Business Automation Workflow 18. 19, 20, 21, and IBM Business Process Manager 8.5 and d8.6 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. 2021-11-05 not yet calculated CVE-2021-29753
CONFIRM
XF insyde — insydeh2o
An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges. 2021-11-03 not yet calculated CVE-2020-5955
CONFIRM
MISC irfanview — irfanview
Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8. 2021-11-05 not yet calculated CVE-2020-23566
MISC irfanview — irfanview
Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. Related to “Integer Divide By Zero starting at JPEG2000!ShowPlugInSaveOptions_W+0x00000000000082ea” 2021-11-05 not yet calculated CVE-2020-23567
MISC irfanview — irfanview
Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. Related to a “Data from Faulting Address controls Branch Selection starting at JPEG2000!ShowPlugInSaveOptions_W+0x0000000000032850”. 2021-11-05 not yet calculated CVE-2020-23565
MISC jeedom — jeedom
In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials. 2021-11-01 not yet calculated CVE-2021-42557
MISC
MISC jenkins — jenkins FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. 2021-11-04 not yet calculated CVE-2021-21694
CONFIRM jenkins — jenkins When creating temporary files, agent-to-controller access to create those files is only checked after they’ve been created in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. 2021-11-04 not yet calculated CVE-2021-21693
CONFIRM jenkins — jenkins FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. 2021-11-04 not yet calculated CVE-2021-21695
CONFIRM
MLIST jenkins — jenkins Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories when using the FilePath APIs, allowing attackers in control of agent processes to replace the code of a trusted library with a modified variant. This results in unsandboxed code execution in the Jenkins controller process. 2021-11-04 not yet calculated CVE-2021-21696
CONFIRM
MLIST jenkins — jenkins
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symbolic link in FilePath#untar. 2021-11-04 not yet calculated CVE-2021-21687
CONFIRM jenkins — jenkins
FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check ‘read’ agent-to-controller access permission on the source path, instead of ‘delete’. 2021-11-04 not yet calculated CVE-2021-21692
CONFIRM jenkins — jenkins
Creating symbolic links is possible without the ‘symlink’ agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. 2021-11-04 not yet calculated CVE-2021-21691
CONFIRM jenkins — jenkins
Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent. 2021-11-04 not yet calculated CVE-2021-21698
CONFIRM
MLIST jenkins — jenkins
File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories. 2021-11-04 not yet calculated CVE-2021-21686
CONFIRM jenkins — jenkins
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. 2021-11-04 not yet calculated CVE-2021-21685
CONFIRM
MLIST jenkins — jenkins
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. 2021-11-04 not yet calculated CVE-2021-21689
CONFIRM jenkins — jenkins
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions. 2021-11-04 not yet calculated CVE-2021-21697
CONFIRM
MLIST jenkins — jenkins
Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. 2021-11-04 not yet calculated CVE-2021-21690
CONFIRM jupyterhub — jupyter_notebooks
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out. 2021-11-04 not yet calculated CVE-2021-41247
CONFIRM
MISC linux — linux_kernel
An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. 2021-11-04 not yet calculated CVE-2021-43389
MISC
MISC
MISC
MISC
CONFIRM
MLIST meross — smart_wi-fi_2_way_wall_switch
Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X), on its 3.1.3 version and before, creates an open Wi-Fi Access Point without the required security measures in its initial setup. This could allow a remote attacker to obtain the Wi-Fi SSID as well as the password configured by the user from Meross app via Http/JSON plain request. 2021-11-05 not yet calculated CVE-2021-3774
CONFIRM miniftpd — miniftpd
A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable, where a crafted payload can be sent to the affected function. 2021-11-04 not yet calculated CVE-2021-42624
MISC mozilla — firefox
Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable. 2021-11-03 not yet calculated CVE-2021-35053
MISC nec — clusterpro
Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote code execution via a network. 2021-11-03 not yet calculated CVE-2021-20703
MISC nec — clusterpro
Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote code execution via a network. 2021-11-03 not yet calculated CVE-2021-20701
MISC nec — clusterpro
Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote code execution via a network. 2021-11-03 not yet calculated CVE-2021-20702
MISC nec — clusterpro
Improper input validation vulnerability in the WebManager CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote file upload via network. 2021-11-03 not yet calculated CVE-2021-20705
MISC nec — clusterpro
Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote code execution via a network. 2021-11-03 not yet calculated CVE-2021-20704
MISC nec — clusterpro
Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to read files upload via network.. 2021-11-03 not yet calculated CVE-2021-20707
MISC nec — clusterpro
Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote code execution via a network. 2021-11-03 not yet calculated CVE-2021-20700
MISC nec — clusterpro
Improper input validation vulnerability in the WebManager CLUSTERPRO X 1.0 for Windows and later, EXPRESSCLUSTER X 1.0 for Windows and later allows attacker to remote file upload via network. 2021-11-03 not yet calculated CVE-2021-20706
MISC obsidian — dataview
Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provides a mitigation for some use cases. 2021-11-04 not yet calculated CVE-2021-42057
MISC owasp — modsecurity_core_rule
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname. 2021-11-05 not yet calculated CVE-2021-35368
CONFIRM
MISC
CONFIRM
MISC phpgurukul — hospital_management_system
Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php. 2021-11-05 not yet calculated CVE-2021-39411
MISC phpgurukul — shopping
Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php, (b) server_side/scripts/jsonp.php, and (c) scripts/objects_jsonp.php, the (2) value parameter in examples_support/editable_ajax.php, and the (3) PHP_SELF parameter in captcha/index.php. 2021-11-05 not yet calculated CVE-2021-39412
MISC pomerium — pomerium
Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user’s claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated. 2021-11-05 not yet calculated CVE-2021-41230
CONFIRM
MISC pybbcms — topicmapper
A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information. 2021-11-01 not yet calculated CVE-2020-28702
MISC python — discord
Python discord bot is the community bot for the Python Discord community. In affected versions when a non-blacklisted URL and an otherwise triggering filter token is included in the same message the token filter does not trigger. This means that by including any non-blacklisted URL moderation filters can be bypassed. This issue has been resolved in commit 67390298852513d13e0213870e50fb3cff1424e0 2021-11-05 not yet calculated CVE-2021-41250
MISC
CONFIRM realtek — rtsupx RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device. 2021-11-02 not yet calculated CVE-2021-36923
MISC
MISC realtek — rtsupx RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device. 2021-11-02 not yet calculated CVE-2021-36924
MISC
MISC realtek — rtsupx
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device. 2021-11-02 not yet calculated CVE-2021-36922
MISC
MISC realtek — rtsupx
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device. 2021-11-02 not yet calculated CVE-2021-36925
MISC
MISC sap — business_technology_Platform
@sap-cloud-sdk/core contains the core functionality of the SAP Cloud SDK as well as the SAP Business Technology Platform abstractions. This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In affected versions and in some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions. By default, destination caching is disabled. The security for caching has been increased. The changes are released in version 1.52.0. Users unable to upgrade are advised to disable destination caching (it is disabled by default). 2021-11-05 not yet calculated CVE-2021-41251
MISC
CONFIRM
MISC seo — panel
Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, and (j) reports.php; the (2) from_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) reports.php; the (3) order_col parameter in (a) analytics.php, (b) review.php, (c) social_media.php, and (d) webmaster-tools.php; and the (4) pageno parameter in (a) alerts.php, (b) log.php, (c) keywords.php, (d) proxy.php, (e) searchengine.php, and (f) siteauditor.php. 2021-11-05 not yet calculated CVE-2021-39413
MISC seo — remote_clinic Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters. 2021-11-05 not yet calculated CVE-2021-39416
MISC
MISC
MISC sitecore — xp
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. 2021-11-05 not yet calculated CVE-2021-42237
MISC
MISC
MISC sonatype — nexus_repository_manager
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account. 2021-11-02 not yet calculated CVE-2021-42568
MISC
MISC sourcecodester — engineers_online_portal A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing “<?php system($_GET[“cmd”]); ?>” the attacker can execute commands on the web server with – /admin/uploads/php-webshell?cmd=id. 2021-11-05 not yet calculated CVE-2021-42669
MISC
MISC sourcecodester — engineers_online_portal
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more. 2021-11-05 not yet calculated CVE-2021-42664
MISC
MISC
MISC sourcecodester — engineers_online_portal
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication. 2021-11-05 not yet calculated CVE-2021-42665
MISC
MISC
MISC sourcecodester — engineers_online_portal
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server. 2021-11-05 not yet calculated CVE-2021-42666
MISC
MISC
MISC sourcecodester — engineers_online_portal
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server. 2021-11-05 not yet calculated CVE-2021-42668
MISC
MISC sourcecodester — engineers_online_portal
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of authentication or authorization. 2021-11-05 not yet calculated CVE-2021-42671
MISC
MISC sourcecodester — engineers_online_portal
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server. 2021-11-05 not yet calculated CVE-2021-42670
MISC
MISC sourcecodester — online_event_booking_and_reservation_system A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server. 2021-11-05 not yet calculated CVE-2021-42667
MISC
MISC sourcecodester — online_event_booking_and_reservation_system
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a given link he will display the content of the HTML code of the attacker’s choice. 2021-11-05 not yet calculated CVE-2021-42663
MISC
MISC stivasoft — fundraising_script Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function. 2021-11-05 not yet calculated CVE-2020-22225
MISC stivasoft — fundraising_script
Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function. 2021-11-05 not yet calculated CVE-2020-22226
MISC stivasoft — fundraising_script
Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview function. 2021-11-05 not yet calculated CVE-2020-22224
MISC stivasoft — fundraising_script
Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss function. 2021-11-05 not yet calculated CVE-2020-22222
MISC stivasoft — fundraising_script
Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function. 2021-11-05 not yet calculated CVE-2020-22223
MISC talend — data_catalog
An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed. 2021-11-05 not yet calculated CVE-2021-42837
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41223
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due to binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41214
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41198
MISC
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41199
CONFIRM
MISC
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.create_file_writer` is called with non-scalar arguments code crashes due to a `CHECK`-fail. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41200
MISC
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41202
CONFIRM
MISC
MISC
MISC
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41203
CONFIRM
MISC
MISC
MISC
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow’s Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41204
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don’t have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41206
MISC
MISC
MISC
MISC
CONFIRM
MISC
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41207
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41212
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41209
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41221
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions TensorFlow’s Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41225
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41226
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41227
CONFIRM
MISC
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41218
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions TensorFlow’s `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41228
MISC
CONFIRM tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41222
CONFIRM
MISC tensorflow — tensorflow TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41215
MISC
CONFIRM tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures) as well as abuse undefined behavior (binding references to `nullptr`s). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call. Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. We will deprecate TensorFlow’s boosted trees APIs in subsequent releases. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41208
MISC
CONFIRM tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using `AddDim`. However, if the number of elements in the tensor overflows an `int64_t` value, `AddDim` results in a `CHECK` failure which provokes a `std::abort`. Instead, code should use `AddDimWithStatus`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41195
CONFIRM
MISC
MISC
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow’s implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41196
MISC
CONFIRM
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an `int64_t`. If an overflow occurs, `MultiplyWithoutOverflow` would return a negative result. In the majority of TensorFlow codebase this then results in a `CHECK`-failure. Newer constructs exist which return a `Status` instead of crashing the binary. This is similar to CVE-2021-29584. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41197
CONFIRM
MISC
MISC
MISC
MISC
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to `true` and never assigns `false`. This results in unitialized variable access if callers assume that `EinsumHelper::ParseEquation()` always sets these flags. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41201
MISC
CONFIRM tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected. 2021-11-05 not yet calculated CVE-2021-41220
CONFIRM
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41219
CONFIRM
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41205
CONFIRM
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41217
MISC
CONFIRM tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41224
MISC
CONFIRM tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41210
MISC
CONFIRM tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected. 2021-11-05 not yet calculated CVE-2021-41211
CONFIRM
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41216
CONFIRM
MISC tensorflow — tensorflow
TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock` Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive `tf.function`, although this is not a frequent scenario. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range. 2021-11-05 not yet calculated CVE-2021-41213
MISC
CONFIRM vim — vim vim is vulnerable to Stack-based Buffer Overflow 2021-11-05 not yet calculated CVE-2021-3928
CONFIRM
MISC vim — vim
vim is vulnerable to Heap-based Buffer Overflow 2021-11-05 not yet calculated CVE-2021-3927
CONFIRM
MISC worx — automation_suite
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory. 2021-11-04 not yet calculated CVE-2021-34597
CONFIRM wp — dsgvo_tools
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question. 2021-11-05 not yet calculated CVE-2021-42359
MISC

Azure Video Analyzer – Ignite Nov 2021

by Contributed | Nov 7, 2021 | Technology

This article is contributed. See the original author and article here.

Intelligent video applications built using existing cameras or newer smart cameras, and edge gateways are at the core of a massive wave of innovation benefiting our customers.

According to the IoT Signals report, the vast majority of companies with a video AI solution strategy see it as an integral part of their IoT solution. Yet, the reality is that building such a solution can be complicated. Azure Video Analyzer is an Azure Applied AI service that greatly reduces the effort needed to build intelligent video applications by capturing, analyzing, and publishing video & inference on the edge or the cloud.

“Vision and AI capabilities on edge devices are helping companies create companies create breakthrough applications,” said Moe Tanabian, Vice President, and General Manager of Azure Edge Devices, Platform & Services, Microsoft. With the latest updates to Azure Video Analyzer, we are making it easier than ever for our customers to build comprehensive AI-powered solutions with actionable insights from videos”

Figure 1: Azure Video Analyzer overview

New Azure Video Analyzer innovations available as of Microsoft Ignite 2021

Since its introduction earlier this year, Azure Video Analyzer capabilities have grown significantly to meet your needs. The Ignite 2021 (November) release provides you with the following new capabilities and enhancements:

Cloud-native video management solutions

Visualization of insights from intelligent video applications

Windows devices optimized for Video AI

The following illustration provides an overview of both existing Azure Video Analyzer capabilities and the new capabilities made available for Ignite 2021.

Figure 2: Azure Video Analyzer capabilities

1. Cloud-native video management solutions

Video Surveillance as a Service (VSaaS) solutions have the convenience of ease of use coupled with the scalability and manageability of cloud computing, making them attractive to enterprises adopting cloud-native solutions. Such solutions offer the same benefits as other cloud services, such as managed infrastructure for IT teams, easy customization, and integration, and remote access from anywhere. Our customers can take advantage of the following features to achieve the desired outcome in these areas.

Azure Video Analyzer enables you to build a VSaaS system to record, store, view, and export video clips from cameras. You can connect RTSP cameras directly to the cloud or via a lightweight gateway device for network isolation. There’s no need to be on-site to view footage and investigate issues; end users can simply log into a cloud-based dashboard via a web browser or mobile app and view the video stream in near real-time (~2 sec latency).

Figure 3: Camera to Azure Video Analyzer Cloud (with or without gateway)

Azure Video Analyzer makes it effortless to create actionable events along with video clips that can be shared with relevant end users quickly & securely via the cloud. Customers are always in control of the video by defining access policies to meet regulatory requirements.

Not every video needs to be processed in real-time at the edge or cloud. With the recent updates to the platform, customers can export a portion of the pre-recorded video stream. This enables scenarios related to long-term storage of relevant snippets, exported clips for AI model training, and video evidence management scenarios.

Figure 4: Azure Video Analyzer low latency video playback

“Safety, security and productivity are essential elements for the growth and sustainability of every society and business. Together Axis Communications and Azure Video Analyzer are empowering developers with the tools to rapidly build and deploy AI-powered solutions that improve operational agility, optimize business efficiency and enhance safety and security” Fredrik Nilsson, Vice President, Americas, Axis Communications

2. Visualization of insights from Intelligent video application

Visualization of AI inference data is necessary to make sense of data generated from Video AI systems. Customers need data visualization to detect anomalies or trends, and so on. With this objective in mind:

You can use widget player npm (node package manager) to customize and readily embed into Power BI or other business intelligence systems or Power Apps or custom applications.

It can be time-consuming to obtain coordinates required to build an intelligent video application (i.e., crossing line, zone). The video player widget also provides an easy tool to draw lines and zones.

This release also marks a significant milestone in our innovations with Azure’s Computer Vision for spatial analysis. Customers can leverage new capabilities like tracking a person’s speed and ground orientation and display them with our widget player.

During upcoming updates, we will enable customers
- To overlay lines/zones for easy visualization while viewing the video from the camera
- To define user attributes (i.e., vests, helmets, bags) and use them with the spatial analysis AI service.

These product investments in Azure Video Analyzer will enable you to visualize actionable insights quickly.

Figure 5: Azure Video Analyzer insights visualization

“We were impressed with the comprehensiveness of the Azure Video Analyzer to build out solutions quickly. The integrations between the Azure Video Analyzer and Scenera’s Platform as a Service will help our customers gain valuable business insights using the solution’s scene-based event analytics..” Andrew Wajs, CTO & Founder of Scenera

3. Windows devices optimized for Video analytics

Manageability of Windows devices and the necessity to run Linux-based containers are key drivers for our investments with “Edge For Linux On Windows” EFLOW. We now guide our developer ecosystem through the PowerShell experience of running EFLOW with Azure Video Analyzer to strengthen this commitment further.

Figure 6: Azure Video Analyzer + EFLOW powering inventory management solution

Finally, use the following resources to learn more about the overall product and services capabilities.

Refer to our Ignite session, Ask the Experts: Solving Real World Problems with Computer Vision at the Edge

Azure Video Analyzer product overview

Azure Video Analyzer product documentation

Azure Video Analyzer GitHub for code samples, SDK’s, open-source projects, reference applications

Azure Video Analyzer technical community articles

Please contact the Azure Video Analyzer product team at videoanalyzerhelp@microsoft.com for feedback and deeper engagement discussions.

Introducing Private Link in Hyperscale (Citus) for Postgres on Azure

by Contributed | Nov 6, 2021 | Technology

This article is contributed. See the original author and article here.

We recently announced the preview of Azure Private Link support for the Hyperscale (Citus) option in our Azure Database for PostgreSQL managed service.

Private Link enables you to create private endpoints for Hyperscale (Citus) nodes, which are exhibited as private IPs within your Virtual Network. Private Link essentially brings Hyperscale (Citus) inside your Virtual Network and allows you to have direct connectivity from your application to the managed database service.

With Private Link, communications between your Virtual Network and the Hyperscale (Citus) service travel over the Microsoft backbone network privately and securely, eliminating the need to expose the service to the public internet.

If you’re not familiar, Hyperscale (Citus) is an option in the Azure Database for PostgreSQL managed service that enables you to scale out your Postgres database horizontally. Hyperscale (Citus) leverages the Citus open source extension to Postgres, effectively transforming Postgres into a distributed database.

As with all the other Azure PaaS services that support Azure Private Link, the Private Link integration with Hyperscale (Citus) in our PostgreSQL managed service implements the same battle-tested Azure Private Link technology, provides the same consistent experiences, and has the following features:

Private access from Virtual Network resources, peered networks, and on-premise networks.

In-built data exfiltration protection for Azure resources.

Predictable private IP addresses for PaaS resources.

Consistent and unified experience across PaaS services.

To learn more about Private Link technology and PaaS services that support Private Link functionality, you can review the general Azure Private Link documentation.

Figure 1: Architecture diagram depicting the secure and private connectivity to Hyperscale (Citus) in the Azure Database for PostgreSQL managed service—when using Private Link

In this “how to” blog post about the Private Link preview¹ for Hyperscale (Citus), you can learn how to bring your Hyperscale (Citus) server groups inside your Virtual Network, by creating and managing private endpoints on your server groups. You will also get to know some of the details to be aware of when using Private Link with Hyperscale (Citus).

Let’s take a walk through these 4 scenarios for using Azure Private Link with Hyperscale (Citus):

How to create a Hyperscale (Citus) server group with a Private Endpoint

How to add a Private Endpoint for an existing server group via Networking blade

How to add a Private Endpoint for an existing server group via Private Endpoint resource creation

How to manage a Private Endpoint Connection

Prerequisites

Before you can create a Hyperscale (Citus) server group with a private endpoint—or add a private endpoint for an existing Hyperscale (Citus) server group—you first need to setup a resource group and a virtual network with a subnet that has enough available private IPs:

The resource group will hold your Hyperscale (Citus) server group.

The virtual network is used to allocate private IPs for your private endpoints.

How to create a Hyperscale (Citus) server group with a Private Endpoint

As the database admin or owner, you can create a private endpoint on the coordinator node when you are provisioning a new Hyperscale (Citus) server group. For help on how to provision a Hyperscale (Citus) server group, take a look at this tutorial.

In the “Networking” tab (Figure 2 below), select by clicking the “Private access” radio button for the “Connectivity method”.

Figure 2: Screen capture from the Azure portal showing the option to create a Hyperscale (Citus) server group with private access connectivity

A “Create private endpoint” screen will appear (Figure 3 below). If this screen doesn’t appear, or you close it accidentally, you can manually re-open it by clicking “+ Add private endpoint” in the “Networking” tab showing above.

Figure 3: Screen capture from the Azure portal showing the “Create private endpoint” screen when “Private access” is selected as the connectivity method

Select appropriate resource group, location, name, and networking values for your private endpoint. If you are just experimenting with Citus on Azure, the default values should work for most cases.

Please pay special attention to the Networking configurations. The networking configurations specify the Virtual Network and Subnet for the private IP from which the new private endpoint will be allocated. For example, you need to make sure there are enough private IPs available in the selected subnet.

The rest of the steps are exactly the same as in the tutorial for creating a Hyperscale (Citus) server group.

How to add a Private Endpoint for an existing server group via the Networking blade

You can also create a private endpoint on a node in an existing Hyperscale (Citus) server group.

In fact, if you need to create a private endpoint on a worker node in a cluster, you must first create the database cluster and then subsequently add the private endpoint to the worker node.

There are two places you can do this, and the first place is through the “Networking” blade for the Hyperscale (Citus) server group.

1. Navigate to the “Networking” blade for the Hyperscale (Citus) server group (Figure 4 below), click “+ Add private endpoint”.

Figure 4: Screen capture from the Azure portal showing the “+ Add Private Endpoint” button in the Networking blade for Hyperscale (Citus) in the Azure Database for PostgreSQL managed service

2. In the “Basics” tab (Figure 5 below), select the appropriate “Subscription”, “Resource group”, and “Region” information where you want your private endpoint to be created, and enter a meaningful “Name” for the private endpoint, e.g., you can use a naming convention like “ServerGroupName-NodeName-pe”. Select “Next: Resource >”.

Figure 5: Screen capture from the Azure portal showing the “Basics” tab for the “Create a private endpoint” flow

3. In the “Resource” tab in the screenshot below (Figure 6 below), choose the target node of the Hyperscale (Citus) server group. Generally, “coordinator” is the desired node unless you have reasons to access to the Hyperscale (Citus) worker nodes. (If you need private endpoints for all the worker nodes, you will need to repeat this process for all target sub-resources). Select “Next: Configuration >”.

Figure 6: Screen capture from the Azure portal showing the “Resource” tab for the “Create a private endpoint” flow

4. In the “Configuration” tab below (Figure 7 below), choose the “Virtual network” and “Subnet” from where the private IP for the private endpoint will be allocated.

It’s not required, but highly recommended to create all your private endpoints for the same Hyperscale (Citus) server group using the same Virtual Network / Subnet.

Select the “Yes” radio button next to “Integration with private DNS zone” to have private DNS integration.

Figure 7: Screen capture from the Azure portal showing the “Configuration” tab for the “Create a private endpoint” flow

5. Finish the rest of the steps by adding any tags you want, reviewing the settings and selecting “Create” to create the private endpoint.

How to add a Private Endpoint for an existing server group via Private Endpoint resource creation

If you need to create private endpoints for more than one Hyperscale (Citus) server group—or for multiple Azure managed services, perhaps you also manage other databases besides Postgres—you can choose to create a private endpoint using the generic private endpoint creation process provided by the Azure Networking team.

You might also want to use generic private endpoint resource creation if you don’t have access to the Hyperscale (Citus) server group, e.g., you are network admin instead of database admin, or you need to create a private endpoint to a database in another subscription you don’t have access to.

1. From the home page of Azure portal, select the “Create a resource” button and search for “Private Endpoint”. Click “Create” button (Figure 8 below) to start creating a private endpoint.

Figure 8: Screen capture from the Azure portal showing the “Create” page for “Create a resource” of Private Endpoint

2. All the rest of the steps should be the same as illustrated in the section above, except for the “Resource” tab step (Figure 9 below).

For the “Resource” tab step, you will need to select the “Connection method” based on your permission to the Hyperscale (Citus) server group on which you want to create a private endpoint. You can learn more in the “Access to a private link resource using approval workflow” docs.

“Connect to an Azure resource in my directory”: if you own or have access to the Hyperscale (Citus) server group (e.g., you are the server group admin), you can choose “Connect to an Azure resource in my directory”. For the “Resource Type” field, please select “Microsoft.DBforPostgreSQL/serverGroupsv2” from the dropdown; for the “Resource” field, you can browse to find the server group on which you want to create a private endpoint.

“Connect to an Azure resource by resource ID or alias”: if you don’t own or don’t have access to the Hyperscale (Citus) server group, you will need to choose “Connect to an Azure resource by resource ID or alias.” Please obtain the resource ID for the Hyperscale (Citus) server group from the Hyperscale (Citus) server group owner.

Figure 9: Screen capture from the Azure portal showing the “Resource” tab for the “Create a private endpoint” flow when you are using Private Endpoint resource creation

How to manage a Private Endpoint Connection

As mentioned above, there are different connection and approval methods based on your permission on the Hyperscale (Citus) server group.

Automatic approval: the private endpoint connection will be approved automatically if you own or have permission on the server group.

Manual approval: the private endpoint connection request will go through the manual-approve workflow, if you don’t have the permission required and would like to connect to the server group.

As the Hyperscale (Citus) server group owner or admin, you can manage all the private endpoint connections created on your server group.

Pending connections: if the “Connection state” for a private endpoint connection is “Pending”, you will be able to “Approve”, “Reject”, or “Remove” the connection.

Approved connections: if the “Connection state” for a private endpoint connection is “Approved”, you will be able to “Reject” or “Remove” the connection.

Just like adding a Private Endpoint for an existing server group, there are two places you as the Hyperscale (Citus) server group admin can manage the private endpoint connections.

The 1st place is again using the Hyperscale (Citus) server group’s “Networking” blade (Figure 10 below).

Figure 10: Screen capture from the Azure portal showing management options for a Private Endpoint Connection in the Networking blade for Hyperscale (Citus) in the Azure Database for PostgreSQL managed service

The 2nd place you can manage the private endpoint connections is the “Private Link Center”. Search “Private Link” services from the Azure portal, and you will be navigated to the “Private Link Center”.

1. The “Pending connections” blade (Figure 11 below) in the “Private Link Center” lists all the private endpoints that are in “Pending” state. You can filter based on “Subscription”, “Name”, and “Resource Type” to the private endpoints you want to manage.

Figure 11: Screen capture from the Azure portal showing all “Pending connections” in the “Private Link Center”

2. The “Private endpoints” blade (Figure 12 below) in the “Private Link Center” lists all the private endpoints in all connection state. Again, you can filter based on “Subscription”, “Name”, and “Resource Type” to the private endpoints you want to manage.

Figure 12: Screen capture from the Azure portal showing all “Private endpoints” in the “Private Link Center”

Private Link is now in preview for Hyperscale (Citus) in our PostgreSQL managed service

With the preview of the Azure Private Link for Hyperscale (Citus), you are now empowered to bring your Hyperscale (Citus) server groups—new or existing—into your private Virtual Network space. You can create and manage private endpoints for any of or all the Hyperscale (Citus) database nodes.

If you want to learn more about using Hyperscale (Citus) to shard Postgres on Azure, you can:

Read our Azure docs for Hyperscale (Citus)

Create your first Azure Database for PostgreSQL – Hyperscale (Citus) server group

Review the multiple layers of data access and security that Hyperscale (Citus) provides in Azure Database for PostgreSQL

Your feedback and questions are welcome. You can always reach out to our team of Postgres experts at Ask Azure DB for PostgreSQL.

Footnotes

At the time of publication, Private Link is in preview in many Hyperscale (Citus) regions and will be rolling out to the rest of the Hyperscale (Citus) in the upcoming months. ↩

Child Tax Credit scammers are still reaching out

by Scott Muniz | Nov 5, 2021 | Security

This article was originally posted by the FTC. See the original article here.

Many people have gotten their advance Child Tax Credit payments this year, but scammers are taking advantage of this new program to try to trick you out of money or information. They’re pretending to be the IRS, contacting people by phone, text, email, and social media — and sending people to official-looking websites that look just like the IRS.

Before you respond to anyone who reaches out to you, here are a few things to know about the IRS and the Child Tax Credit:

Check your eligibility for the tax credit, if you haven’t gotten any advance payment this year, and sign up by following the IRS’ instructions.
The IRS used information from filed tax returns to automatically sign people up for the Child Tax Credit. If you aren’t getting payments automatically, it might be because you didn’t file a tax return for 2019 or 2020. You’ll need to sign up for these payments if you didn’t file.
The IRS (and other government agencies) will never text, email, or contact you on social media asking for your personal or financial information. But scammers will.
The IRS does not use robocalls and will not call about something urgent or threatening. The IRS will also not call to ask taxpayers to give or verify financial information to get your Child Tax Credit payments. Anyone who does is a scammer.
The IRS will never ask for a payment by gift card, wire transfer, or cryptocurrency. The IRS and other government agencies will also never ask you to pay to get financial help. You know who does? Scammers.

If you have questions, start at irs.gov to get answers. And if someone says they’re from the IRS and contacts you about the Child Tax Credit, report it to the IRS and ReportFraud.ftc.gov. If you think a scammer has any of your personal or financial information, visit IdentityTheft.gov to get a recovery plan.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

A data-driven approach to managing devices in your organization

by Contributed | Nov 5, 2021 | Technology

This article is contributed. See the original author and article here.

The recent shift to hybrid and remote work is changing the way organizations manage enterprise devices. Many organizations are moving to modern cloud management solutions. IT Pros tell us that most have become familiar with the Windows servicing model and the deployment of regular feature updates and are using – or planning to use – Windows Update for Business to automate updates. We also hear that application compatibility is less of a concern for most organizations as it was when Windows 10 was introduced.

We’re working to make Windows update readiness insights more accessible with the goal to provide you with the insights you need to confidently deploy Windows without adding any unnecessary complexity. To align our investments with this goal and the shift we have been seeing, we are announcing that we will retire Desktop Analytics on November 30, 2022. Over the next year, we will begin incorporating the types of insights found in Desktop Analytics directly into the Microsoft Endpoint Manager admin center, making them available for PCs that are managed via Intune-only, co-managed, and Configuration Manager with tenant attach.

We have already started this work with the addition of Windows 11 hardware readiness insights in Endpoint analytics as a part of Microsoft Endpoint Manager. These insights help you quickly determine which of your managed PCs meet the minimum system requirements for Windows 11 and the top hardware blockers both at the device level and across your organization. By building these insights in Endpoint analytics, they’re now available for Intune-managed and co-managed devices, in addition to Configuration Manager devices with tenant attach enabled.

Device-level Windows 11 readiness details in Endpoint analytics

New Reports in Microsoft Endpoint Manager admin center

In the coming months, we’ll be releasing device-level upgrade and update readiness insights directly in the Reports node of the Microsoft Endpoint Manager admin center, giving you insights for all your Endpoint Manager-managed devices. These reports will tell you if any of your Windows devices have application or driver compatibility risks or Safeguard holds that will prevent an upgrade from Windows 10 to Windows 11 – or a feature update from one version of Windows to another. We will also show you the top compatibility risks across your organization making it easy to see which impact the largest number of devices so that you can prioritize fixes effectively.

We’ll be moving away from the workflow-based model of Desktop Analytics toward a data-first approach. Many IT Pros have provided feedback that the data in Desktop Analytics is what they find most valuable, but the tool comes with a steep learning curve before they can access the data. We’re looking forward to improving this by making compatibility insights simpler and more accessible without the need to manage another workload, while making them ready to use with modern Windows servicing tools.

Additional devices in scope

While the insights in our new reports will be similar to what was available in Desktop Analytics, our approach is evolving based on your feedback and years’ worth of learnings to make Windows updates easier than ever before. We’re committed to helping you adopt a modern management approach for your organization. By making Windows 10 and 11 insights available in the Microsoft Endpoint Manager admin center, they’ll soon be available for all MEM-managed PCs – including Intune-only, co-managed, and Configuration Manager with tenant attach.

Simplified Configuration Manager cloud attach story

This change also allows us to simplify your overall Configuration Manager cloud management strategy. Historically, there have been very similar, but separate processes for configuring Desktop Analytics and tenant attach which created additional overhead. With these new investments, you’ll no longer need to maintain separate configurations. Instead, simply tenant attach or co-manage your devices to take advantage of all the additional cloud-powered capabilities available to you in the cloud console.

Our application compatibility promise

Windows 11 continues Microsoft’s strong commitment to app compatibility. Our goal is to ensure that apps will work after an upgrade to Windows 11, with no changes required. In the years that our App Assure service has been working with organizations to help them resolve app compat issues, they have seen a 99.6% app compatibility rate. For organizations where application compatibility is still a concern, such as those with many highly specialized or custom line of business (LOB) applications, don’t worry! App Assure is ready to assist, and you can also use Test Base for Microsoft 365 to onboard and validate apps for Windows 11 in a Microsoft managed environment. For more information, see Microsoft extends application compatibility promise to Windows 11.

What should I do now?

We’ll have more information about our investments in this area over the next several months. In the meantime, there are several steps you can take today to prepare. First, ensure that your PCs are on a supported version of Windows 10. You’ll be able to leverage Desktop Analytics for Windows 10 feature updates until November 30, 2022. Next, if you’re using Configuration Manager, enable tenant attach and integrate your site with your Azure Active Directory (Azure AD) tenant. You’ll get several immediate benefits – such as access to the cloud console – and this will leave you well-positioned to benefit from our upgrade and update readiness insights as soon as they’re available.

After enabling tenant attach, or if you’re using Intune to manage PCs, onboard to Endpoint analytics to take advantage of Windows 11 hardware readiness insights. Understanding which managed devices meet the minimum system requirements is one of the first steps in planning for a Windows 11 upgrade.

We’re looking forward to helping you along your modern management journey and making it simple for you to upgrade to and manage Windows 11.

Continue the conversation. Find best practices. Visit the Windows Tech Community.

Stay informed. For the latest updates on new releases, tools, and resources, stay tuned to this blog and follow us @MSWindowsITPro on Twitter.

Detecting Emerging Threats with Microsoft Sentinel Fusion

by Contributed | Nov 4, 2021 | Technology

This article is contributed. See the original author and article here.

The volume of security events continues to grow, and the scope and sophistication of attacks are increasing. We can define the known attack scenarios, but how about the emerging and unknown threats in your environment?

We are excited to announce that we are releasing an extended Fusion ML detection capability that can help you find the emerging and unknown threats in your environment by applying extended ML analysis and by correlating a broader scope of anomalous signals, while keeping the alert fatigue low.

This release includes:

A new set of machine learning algorithms that detect emerging threat patterns automatically to stop attacks at an early stage.

Extended source signal coverage for all the assets monitored by the SOC team in a Microsoft Sentinel workspace by supporting custom scheduled rules, out-of-the box anomalies, and additional Microsoft products.

A new configuration UI that allows security analysts to configure source signals and to exclude specific detection patterns that may not be applicable to your environment from Fusion detection to further reduce alert fatigue.

The new set of machine learning algorithms

Available at no additional cost to Microsoft Sentinel customers, Fusion runs at cloud scale and processes billions of signals daily. Fusion uses multiple machine learning algorithms and a probabilistic kill-chain to correlate signals across multiple-clouds, on-premises, and at Edge, to identify sophisticated and novel multistage attacks.

With this extended capability, our ML detections can go beyond the known attack scenarios. The new set of Fusion ML algorithms constantly learn from existing attacks, apply analysis based on how the real security analysts think, and find the threats we have not seen previously from millions of anomalous behaviors and suspicious activities across the kill-chain in your environment to help you stay one step ahead of the attackers.

As you investigate and close Fusion incidents, we encourage you to provide feedback on whether this incident was a True Positive, or a False Positive. Your incident conclusions in Microsoft Sentinel are used as labels in Fusion ML algorithms. The more accurate the conclusion, the better efficacy you get from Fusion in your environment.

Extended detection coverage for your assets

Alerts from the custom scheduled analytics rules

In Microsoft Sentinel, security analysts build KQL-based scheduled rules to monitor the assets in their environment. Oftentimes while investigating an incident triggered by scheduled rule, a security analyst starts with a single alert, runs multiple queries to gather related alerts and anomalies, and then manually associate those alerts and activities with the kill-chain to form a complete picture and the attack path.

Fusion ML algorithms take care of the manual analysis and correlations, making it easy to find a needle in a haystack. Now that Fusion has extended the coverage to all the built-in and custom scheduled rules, the detections can reach every asset monitored by the SOC team in an enterprise, including signals from end points, network, and multi-clouds. With organization and domain knowledge encoded in the custom rules, Fusion can identify the sophisticated emerging threats that are specific to the customer environment.

Identify emerging threats with out-of-the-box anomalies

Rule-based detections are efficient for detecting known attacks, but they do not always adapt to new attack techniques and patterns. With the ML-based out-of-the-box anomalies and the new set of ML algorithms in this release, Fusion can identify novel attacks by associating unusual behaviors in the environment with the learning from known attack patterns, IoCs, past incidents, customer feedback and the Microsoft internal security labels.

An example

The example below shows a possible attack started with initial access from the Cloud to end point execution, and then moved on to consistent beaconing from an internal IP address to a suspicious external one in roughly 24 hours. The Fusion ML algorithms detected this attack by correlating anomaly (Anomalous Azure AD sign-in sessions), as well as alerts from custom scheduled rules, Azure Defender, and Microsoft Defender for Endpoint.

Customizable data sources and results

The new Fusion configuration UI allows security analysts to fine tune the input and output of Fusion. You can specify the input source signals to define the scope monitored by Fusion and exclude specific detection patterns that may not be applicable to your environment from Fusion detection.

We encourage you to try out the new capabilities and let us know what you think – provide your feedback when you close an incident and share additional insights on your product experience through “Guides & Feedback” in Sentinel. Your feedback is critical to help us shape the product!

For more information:

Microsoft Sentinel Fusion

Configure Fusion rule

Sentinel uncovers the real threats hidden in billions of low fidelity signals

Sentinel GitHub repo

BrakTooth Proof of Concept Tool Demonstrates Bluetooth Vulnerabilities

by Scott Muniz | Nov 4, 2021 | Security, Technology

This article is contributed. See the original author and article here.

On November 1, 2021, researchers publicly released a BrakTooth proof-of-concept (PoC) tool to test Bluetooth-enabled devices against potential Bluetooth exploits using the researcher’s software tools. BrakTooth—originally disclosed in August 2021—is a family of security vulnerabilities in commercial Bluetooth stacks. An attacker could exploit BrakTooth vulnerabilities to cause a range of effects from denial-of-service to arbitrary code execution.

CISA encourages manufacturers, vendors, and developers to review BRAKTOOTH: Causing Havoc on Bluetooth Link Manager and update vulnerable Bluetooth System-on-a-Chip (SoC) applications or apply appropriate workarounds.

« Older Entries

Next Entries »

Why Minimal API

How is it different from a normal Web API?

Your first API

Explaining the parts

Creating a builder

Creating the app instance

Defining the routes

Starting the app

Add routes

Example app

Learn more

Conversational intelligence to be more effective in closing deals

Collaborate anywhere and everywhere to bring deal teams together

Personal productivity to be more efficient and effective

Resources and links

New Azure Video Analyzer innovations available as of Microsoft Ignite 2021

1. Cloud-native video management solutions

2. Visualization of insights from Intelligent video application

3. Windows devices optimized for Video analytics

Prerequisites

How to create a Hyperscale (Citus) server group with a Private Endpoint

How to add a Private Endpoint for an existing server group via the Networking blade

How to add a Private Endpoint for an existing server group via Private Endpoint resource creation

How to manage a Private Endpoint Connection

Private Link is now in preview for Hyperscale (Citus) in our PostgreSQL managed service

New Reports in Microsoft Endpoint Manager admin center

Additional devices in scope

Simplified Configuration Manager cloud attach story

Our application compatibility promise

What should I do now?

The new set of machine learning algorithms

Extended detection coverage for your assets

Alerts from the custom scheduled analytics rules

Identify emerging threats with out-of-the-box anomalies

An example

Customizable data sources and results

Recent Posts

Recent Comments

Archives

Categories

Meta

We look forward to meeting you