Task Scheduler S4U Logon Elevation of Privilege

The windows task scheduler allows a split token administrator to register a task which runs as a batch job from a limited privilege context. This doesn’t require a user’s password to accomplish as the task will be run non-interactively and so doesn’t need access to the password in order to access...

Security Bulletin: Multiple vulnerabilities in current releases of the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition v4.1.1 and v4.2, which were disclosed in the Oracle October 2019 Critical Patch Update. Vulnerability Details Refer to the security bulletinss listed ...

Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos TM1

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 used by IBM Cognos TM1. These issues were disclosed as part of the IBM Java SDK updates in January 2018 and April 2018. Multiple Open Source OpenSSL vulnerabilities have also been addressed. Vulnerability Detai...

Hundreds of Millions of PC Components Still Have Hackable Firmware

The lax security of supply chain firmware has been a known concern for years—with precious little progress being made...

Security Bulletin: Vulnerability in IBM Java Runtime affects Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2019-2989)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8 and Version 7 used by Watson Explorer and Watson Explorer Content Analytics Studio. Watson Explorer and Watson Explorer Content Analytics Studio have addressed the applicable CVE. Vulnerability Details CVEID: CVE-2019-29...

Sylius ResourceBundle Information Disclosure Vulnerability

Sylius is a set of Symfony framework based on open source e-commerce platform . An information disclosure vulnerability exists in Sylius ResourceBundle. The vulnerability stems from a configuration or other error in the operation of a network system or product. An unauthorized attacker can exploi...

Nextcloud Talk Authorization Issues Vulnerability

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud Talk is vulnerable to an authorization issue. The vulnerability stems from errors such as configuration during operation of a networked system or...

Linux KVM Information Disclosure Vulnerability

Linux KVM is a kernel-based virtual machine for Linux. An information disclosure vulnerability exists in Linux KVM. The vulnerability stems from errors such as configuration during operation of a networked system or product. An unauthorized attacker could exploit the vulnerability to obtain...

LDAP Windows Update (ADV190023) and Impact to Citrix Virtual Apps and Desktop Components

Impact to Citrix Technology This update will not impact Citrix Virtual App and Desktop Windows components: The update anticipated for the second half of 2020 requires SSL/TLS encryption for communication occurring over 389 and 636 to prevent any PLAINTEXT communication over both ports. Virtual Ap...

CVE-2020-0746

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'...

Information disclosure

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'...

CVE-2020-0746

Technical details about CVE-2020-0746 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2020-0746

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'...

Microsoft Graphics Components Information Disclosure Vulnerability

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information that could be useful for further exploitation. To exploit the vulnerability, a user would have t...

February 11, 2020—KB4532691 (OS Build 17763.1039)

February 11, 2020—KB4532691 OS Build 17763.1039 Applies To Windows 10, version 1809, all editions Windows Server version 1809 Windows Server 2019, all editions Note This release also contains updates for Microsoft HoloLens OS Build 17763.1039 released February 11, 2020. Microsoft will release an...

CVE-2020-0746: Undefined Security Weakness

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'...

PT-2020-1710

Name of the Vulnerable Software and Affected Versions Microsoft Graphics Components affected versions not specified Description An information disclosure issue exists in the way Microsoft Graphics Components handle objects in memory. This could allow an attacker to disclose protected information...

Oracle WebLogic Server Unauthorized Access

The vulnerability of the WLS Core Components component of Oracle WebLogic Server applications is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

Oracle WebLogic Server Unauthorized Access

The vulnerability of the WLS Core Components component of Oracle WebLogic Server applications is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP protocol...

Oracle WebLogic Server Unauthorized Access

The vulnerability of the WLS Core Components component of Oracle WebLogic Server applications is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the IIOP protocol...