5 Ways Your Software Supply Chain is Out to Get You, Part 2: Exploit Third Party Applications

In Part 1 of this series, we explained how and why our software supply chain transfers an extraordinary amount of risk downstream to the organizations and users that trust and depend on it. We also presented evidence suggesting that 2021 may well be the year of the Software Supply Chain attack...

Unspecified Vulnerability in Samsung SMR (CNVD-2021-30497)

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in versions prior to SMR APR-2021 Release 1 that stems from faulty access control allowing untrusted applications to access a running process to...

Samsung SMR Information Disclosure Vulnerability (CNVD-2021-30500)

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in SMR APR-2021 Release 1 that stems from allowing unprivileged applications to access contact information. No detailed vulnerability details are...

Samsung SMR Access Control Error Vulnerability

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in SELinux policy SMR APR-2021 Release 1 prior to APR-2021 Release 1, which stems from an improper SELinux policy, and can be exploited by a local...

Receiver For Windows - Unable to Maximize Published Applications

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. When several published and non-published apps are launched, the minimized published applications...

Unspecified Vulnerability in Oracle Applications Manager

Oracle Applications Manager is an application management software from Oracle USA. The software provides monitoring, trending, and fault management for Oracle data files. A security vulnerability exists in Oracle Applications Manager View Reports 12.1.3, 12.2.3-12.2.10, which allows a highly...

Samsung SMR Path Traversal Vulnerability

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A path traversal vulnerability exists in versions prior to SMR APR-2021 Release 1, which stems from faulty access control and can be exploited by an attacker to read or write...

XWiki Platform Cross-Site Scripting Vulnerability

Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. XWiki Platform has a cross-site scripting vulnerability that can be exploited by attackers to persistently inject scripts...

The vulnerability of the ABAP Server component of the SAP NetWeaver software integration platform allows a hacker to inject arbitrary code.

The vulnerability of the ABAP Server component of the SAP NetWeaver software integration platform is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2021-39954)

Oracle E-Business Suite is in the original Application ERP based on the expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on a variety of management software collection, is seamlessly integrated with a management...

Oracle Secure Global Desktop Input Validation Error Vulnerability

Oracle Secure Global Desktop is a secure remote access solution for any cloud-hosted enterprise application and hosted desktop running on Microsoft Windows, Linux, Oracle Solaris and mainframe servers. A security vulnerability exists in the Server component of Oracle Secure Global Desktop version...

Oracle Applications Manager 安全漏洞

Oracle Applications Manager is an application management software from Oracle USA. The software provides monitoring, trending, and fault management for Oracle data files. A security vulnerability exists in Oracle Applications Manager View Reports 12.1.3, 12.2.3-12.2.10, which allows a highly...

Oracle Applications Framework 安全漏洞

Oracle E-Business Suite is in the original Application ERP based on the expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on a variety of management software collection, is seamlessly integrated with a management...

[SECURITY] Fedora 32 Update: nodejs-12.22.1-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Security Bulletin: WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, contains a vulnerability in Dojo (CVE-2020-5258)

Summary WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, contains a vulnerability in Dojo CVE-2020-5258 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Affected Products and...

Security Bulletin: WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to a Server-side Request Forgery vulnerability (CVE-2021-20480)

Summary WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to a Server-side Request Forgery vulnerability CVE-2021-20480 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

[SECURITY] Fedora 33 Update: nodejs-14.16.1-1.fc33

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Security Bulletin: WebSphere Application Server, which is a component of IBM Cloud Pak for Aplications, is vulnerable to a Directory Traversal vulnerability (CVE-2020-5016)

Summary WebSphere Application Server is shipped as a component of IBM Cloud Pak for Applications. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Potential sensitive data exposure in applications using Vaadin 15

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController - https://vaadin.com/security/cve-2020-36319...

Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 Vaadin 12.0.0 through 14.4.9, and 6.0.0 through 6.0.1 Vaadin 19.0.0 allows attacker to access application classes and resources on the server via crafted HTTP request. -...