SUSE SLES15 Security Update : flatpak (SUSE-SU-2022:3439-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3439-1 advisory. - CVE-2021-41133: Fixed sandbox bypass via recent syscalls bsc1191507. Tenable has extracted the preceding description block directly from t...

Optimizing a Web Application Security Scan for bWAPP

Today almost all organizations have an online presence, with more information accessible at the click of a mouse, making customer experiences much more frictionless. Yet the delivery of great experiences also opens the door to potential hackers intent on compromising the website and its APIs...

Security Bulletin: TXSeries for Multiplatforms is vulnerable to a denial of service exposure due to IBM SDK, Java Technology Edition

Summary IBM SDK, Java Technology Edition is used by TXSeries for Multiplatforms to run WebSphere Liberty, Fix Installer and Java based CICS applications. The fix removes the denial of service vulnerability CVE-2022-21299 from IBM SDK, JTE. Vulnerability Details CVEID:CVE-2022-21299 DESCRIPTION: A...

Delete Passwords: Passwordless Connections for Spring Boot Apps to Azure Services

Using username/password credentials to access one application from another presents a huge security risk for many reasons. Today, we are announcing the preview of passwordless connections for Java applications to Azure database and eventing services, letting you finally shift away from using...

SUSE: Security Advisory (SUSE-SU-2022:3390-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:3391-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Native Support in Spring Boot 3.0.0-M5

The Spring Team has been working on native image support for Spring Applications for quite some time. After 3+ years of incubation in the Spring Native experimental project with Spring Boot 2, native support is moving to General Availability with Spring Framework 6 and Spring Boot 3! Native image...

Security Bulletin: IBM Tivoli Monitoring clients affected by vulnerabilities in IBM JRE excuted under a security manager.

Abstract These vulnerabilities are only applicable to Java deployments where untrusted code may be executed under a security manager e.g. Java applets running in a web browser. Content DESCRIPTION: There are a number of vulnerabilities in the IBM JAVA SDK that affect various components ORB, XML a...

Security Bulletin: CICS Transaction Gateway for Multiplatforms

Abstract Multiple security vulnerablilities exist in the JREs shipped with CICS TG for client applications. CICS TG itself is not vulnerable to these risks but client side applications using the JREs might be. You will need to evaluate your own code to determine if you are vulnerable. Content...

Security Bulletin: CICS Transaction Gateway for Multiplatforms

Abstract Multiple security vulnerablilities exist in the JREs shipped with CICS TG for client applications. CICS TG itself is not vulnerable to these risks but client side applications using the JREs might be. You will need to evaluate your own code to determine if you are vulnerable. Content...

Security Bulletin: Potential security vulnerabilities with JavaTM SDKs

Abstract Smarter Infrastructure Products - Potential security exposure when using JavaTM based applications due to vulnerabilities in Java Software Developer Kits. See Vulnerability Details for CVE IDs. Content VULNERABILITY DETAILS: Customers who have Java based applications, such as Maximo Asse...

Frontier 安全漏洞

Frontier is an EtherCompatible layer for Substrate. It is used to run unmodified Ethernet Dapps. Frontier has a security vulnerability that stems from the fact that the worst-case weight is always used as the block weight for all cases...

New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

By Deeba Ahmed According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. This is a post from HackRead.com Read the...

Adobe InDesign product buffer overflow vulnerability

Adobe InDesign, a set of typesetting and editing applications from Adobe, has a buffer overflow vulnerability that originates from out-of-bounds reads and could lead to a memory leak. An attacker can remotely execute arbitrary code through this vulnerability...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-66020)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. Adobe Experience Manager is...

Malicious OAuth applications abuse cloud email services to spread spam

Microsoft researchers recently investigated an attack where malicious OAuth applications were deployed on compromised cloud tenants and then used to control Exchange Online settings and spread spam. The investigation revealed that the threat actor launched credential stuffing attacks against...

nss bug fix and enhancement update

An update is available for nss. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Network Security Services NSS is a set of libraries designed to support the...

Adobe InDesign Heap Buffer Overflow Vulnerability (CNVD-2022-79412)

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

SUSE SLES15: flatpak / flatpak-devel / flatpak-zsh-completion / libflatpak0 / etc (SUSE-SU-2022:3284-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3284-1 advisory. - CVE-2021-41133: Fixed sandbox bypass via recent syscalls bsc1191507. - CVE-2021-43860: Fixed metadata validation bsc1194610...

Adobe InDesign out-of-bounds read vulnerability (CNVD-2022-79421)

Adobe InDesign, a set of typesetting and editing applications from Adobe, has an out-of-bounds read vulnerability that could be exploited by attackers to cause a sensitive memory leak...