Łukasz Anwajler

More often than not, it is impossible to deal directly with software owners. The majority of large-scale software service suppliers make use of software distributors to distribute their software throughout the globe, without having to worry about jurisdiction. This is accomplished through the use of software distribution agreements, entered into by software owners and software distributors. Key concepts for viable software distribution agreements include: • The details of the parties entering into the agreement • The terms and exclusivity of the agreement  • The agreement should indicate jurisdiction • The payment terms of the agreement  • That the software owner owns the software and that the software distributor wants to distribute/ sell the software • The length of the agreement • The parties must have the relevant licenses (SDA and EULA) • That the required training be made available • The right to terminate the agreement and the terms on which a party may terminate Unambiguous software distribution agreements are of paramount importance when resellers distribute software. GP Bouwer Attorneys are experienced ICT Law attorneys. Let our expert team draft your software license agreement or peruse your existing agreement to safeguard your legal standing. Contact us for legal council on software distribution agreements today. Cell: +27 (76) 592-7164 Email: [email protected] Web: https://lnkd.in/dsnqk_84 #SoftwareDistribution #SoftwareDistributionAgreements #Contracts #ICTLaw #ITLaw #InformationCommunicationsAndTechnology #Attorneys #LegalServices #LegalCouncil

You will be very happy to hear that we can create a desktop application as: 1) Looking similar as website. 2) Desktop application will fully responsible 3) Using JPA (Hibernate) 4) No need to create manual database table 5) Connecting to Online We can do it by JavaFX Spring Boot project where included most hit topic: 1) html 2)CSS 3)JavaScript 4)jQuery 5)Bootstrap Example video:

The latest update for #DotcomMonitor includes "How to Handle and Troubleshooting SIP 400 Bad Request Error" and "Top 10 #SyntheticMonitoring Tools for 2024". #monitoring #websitemonitoring #testing #loadtesting https://lnkd.in/dTNjf6w

🚀 Avoid the 4 biggest mistakes in outsourcing software development and ensure your project's success! Learn how to secure knowledge transfer, maintain quality, document comprehensively, and follow best practices. Discover more in our latest blog post. 🔗 https://lnkd.in/eQ5cK92G \#Outsourcing \#SoftwareDevelopment \#BusinessStrategy \#SpecializedSkills

From writing a spec to commenting your code, adding documentation or descriptions to escalated tickets, explaining what you're doing is fundamental to the job. When in doubt, overcommunicate. https://ow.ly/Q1Vr50Rgmvs #fractionalcto #cto #softwarearchitect #softwareengineer #softwaredevelopment #tech #technology #techsavvy #chieftechnologyofficer

Harvesting the Database & 5 CVEs in TOPqw WebportalTOPqw Webportal is a web application developed by bit baltic information technologies GmbH for social service providers such as local authorities. It can be used to publicly view information about various facilities. For providers and their facilities, there is a login-protected area in which services can be adjusted, statistics viewed and various documents exchanged. The software is used by over 12 federal states all over Germany and the application stores sensitive personal information about citizens as well as confidential documents such as applications for social matters. As part of two penetration tests G DATA ADAN conducted, we identified some partly critical vulnerabilities and for five of the found vulnerabilities we applied for and received CVEs. bit baltic information technologies GmbH reacted quickly when notified of the vulnerabilities and fixed them immediately. GD ADAN followed the principles of Responsible Disclosure when releasing the CVEs. Overview of the CVEs CVE Number Name Severity CVE-2024-45876 Unauthenticated SQL Injection Critical CVE-2024-45875 Authenticated SQL Injection High CVE-2024-45877 Broken Access Control High CVE-2024-45879 Stored Cross-Site Scripting (XSS) in “QWKalkulation” Medium CVE-2024-45878 Stored Cross-Site Scripting (XSS) in “Stammdaten” Medium CVEs in Detail Unauthenticated SQL Injection (CVE-2024-45876) The login form of baltic-it TOPqw Webportal v1.35.283.2 in /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows the manipulation of SQL queries. By exploiting this, it was possible to gain complete access over the database. Finding the SQL injection was actually quite simple. If a single quote (‘) was used in the username during the login, an SQL error message was returned. Figure 01 shows such a request using Test as the username. The response contains a StackTrace with the SQL error message. Figure 01: A stacktrace is returned when the username contains a single quote (') Thefore, this can be considered an error-based SQL injection. sqlmap was used to easily prove exploitability. Figure 02 shows a portion of the sqlmap enumerations. In addition to names, addresses, email addresses, and hashed passwords, files stored in the database could be accessed. However, it was not possible to achieve remote code execution (xp_cmdshell was deactivated ) or write files to the server. Figure 02: Exploitation of the SQL Injection using sqlmap Authenticated SQL Injection (CVE-2024-45875) The SaveNewUser function in TOPqw Webportal v1.35.287.1 in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to an authenticated SQL injection. The JSON object Username allows the manipulation of SQL queries. By exploiting this, it was possible to gain complete access over the database. If an administrative user creates a new user in the TOPqw Webportal and enters a

New Vulnerability Report! CVSS 6.5 On 05 August 2024, a Cross Site Scripting vulnerability with a CVSS score of 6.5 was identified in the WordPress Zephyr Project Manager Plugin version 3.3.100 or earlier. This moderately dangerous vulnerability is expected to be exploited. Report link: https://lnkd.in/g5cD8Uxj #patchstack #cybersecurity #WordPress #opensource #vulnerability #updatenow #technews #securityalert #websecurity #infosec