Most recent entries from all

fkie_cve-2025-34412

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it identified a vulnerability in a SaaS product that does not require user action.

GCVE-1988-2026-0185 — Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Gr…

Affected: unknown

Hello everyone,

Kindly let me introduce myself. This is the first – and potentially, last – message on this mailing list. I am Marco, the CISO of EQS Group. Kindly allow me to address some of the statements expressed publicly here.

About the Convercent application

Convercent was acquired by OneTrust in 2021, and in turn, EQS has acquired it from OneTrust at the end of 2024. Before being acquired by EQS, the Convercent application has not received much love in the latest years, and EQS has since then proceeded to migrate its customers to the EQS Compliance COCKPIT, which is a modern, supported, and secure SaaS. The Convercent application is sunset and will be finally switched off by mid of 2026.

Currently, Convercent is supported by EQS on a best-effort basis; despite that, EQS Group has committed to fix all critical vulnerabilities until the last customer is fully migrated. We want our customers to migrate to our best service because it is better – not rush them in our new product because what we inherited from an acquisition is insecure.

The vulnerabilities

The two issues disclosed are either minor in nature or do not constitute vulnerabilities. One was a lack of certain HTTP headers (some of the reported ones where wrong, but regardless, still hardly something CVE-worthy), and the second was about an “exposed” API; however, it is public by design as this is how the application works: it is a page where customers – who have explicitly agreed an…

GHSA-2gvp-7c85-h6vg

The Convercent Whistleblowing Platform operated by EQS Group contains a protection mechanism failure in its browser and session handling. By default, affected deployments omit HTTP security headers such as Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy, and implement incomplete clickjacking protections. The application also issues session cookies with insecure or inconsistent attributes by default, including duplicate ASP.NET_SessionId values, an affinity cookie missing the Secure attribute, and mixed or absent SameSite settings. These deficiencies weaken browser-side isolation and session integrity, increasing exposure to client-side attacks, session fixation, and cross-site session leakage.