Advisory ROSA-SA-2024-2406

software: gcc 11.4.0 OS: ROSA-CHROME packageevrstring: gcc-11.4.0-10 CVE-ID: CVE-2023-4039 BDU-ID: 2023-05920 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the stack protection feature of the GNU Compiler Collection GCC stack for various programming languages involves a breach of the data...

Picking fights and gaining rights, with Justin Brookman: Lock and Code S05E09

This week on the Lock and Code podcast… Our Lock and Code host, David Ruiz, has a bit of an apology to make: “Sorry for all the depressing episodes.” When the Lock and Code podcast explored online harassment and abuse this year, our guest provided several guidelines and tips for individuals to lo...

ROS-20240422-05

The golang package vulnerability is related to errors returned from MarshalJSON methods containing data, controlled by the user. Exploitation of the vulnerability could allow an attacker acting remotely, exploit these errors to disrupt the contextual behavior of the automatic output of the packag...

The vulnerability of the Web Intelligence component of the SAP BusinessObjects Business Intelligence platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web Intelligence component of the SAP BusinessObjects Business Intelligence platform is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the OpenKeychain data encryption and digital signature verification program lies in the insufficient protection of operational data, allowing attackers to gain unauthorized access to the protected information.

The vulnerability of the OpenKeychain data encryption and digital signature verification program is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the protected information...

The vulnerability of the cross-platform integrated development environment for software, JetBrains Rider, arises from insufficient protection of registration data, allowing attackers to disclose protected information.

The vulnerability of the cross-platform integrated software development environment JetBrains Rider is related to insufficient protection for registration data. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability in the demon probe_serviced component of the testing and monitoring platform for physical, hybrid, and virtual networks, Paragon Active Assurance (previously known as Netrounds), allows a intruder to gain unauthorized access to protected information.

The vulnerability of the demon probeserviced testing and monitoring platform for physical, hybrid, and virtual networks of Paragon Active Assurance previously known as Netrounds is related to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor,...

Data Matters — The Value of Visibility in API Security

...

Recover from Ransomware in 5 Minutes—We will Teach You How!

Super Low RPO with Continuous Data Protection: Dial Back to Just Seconds Before an Attack Zerto, a Hewlett Packard Enterprise company, can help you detect and recover from ransomware in near real-time. This solution leverages continuous data protection CDP to ensure all workloads have the lowest...

PT-2024-24718 · Unknown · Dsgvo Youtube

Name of the Vulnerable Software and Affected Versions: DSGVO Youtube versions 1.4.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with security features allows a perpetrator to circumvent security restrictions.

The vulnerability of the Secure Boot protocol for operating systems running Windows is related to a breach in the data protection mechanism. Exploiting this vulnerability could allow an attacker to circumvent security restrictions...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to insufficient protection of operational data, allows a hacker to disclose protected information.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to disclose protected information remotely...

Enforce and Report on PCI DSS v4 Compliance with Rapid7

The PCI Security Standards Council PCI SSC is a global forum that connects stakeholders from the payments and payment processing industries to craft and facilitate adoption of data security standards and relevant resources that enable safe payments worldwide. According to the PCI SSC website, “PC...

PT-2024-3244 · Mitel · Mitel 6900 Series +3

Name of the Vulnerable Software and Affected Versions: Mitel 6800 Series versions through 6.3 SP3 HF4 Mitel 6900 Series versions through 6.3 SP3 HF4 Mitel 6900w Series SIP Phone versions through 6.3.3 Mitel 6970 Conference Unit versions through 5.1.1 SP8 Description: The issue is related to...

Moderate: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update

OpenShift API for Data Protection OADP 1.3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

The vulnerability of the programming tools for programmable logic controllers (PLCs), EcoStruxure Control Expert and EcoStruxure Process Expert, arises from insufficient protection of registration data. This allows a malicious individual to gain unauthorized access to the project file.

The vulnerability of the programming tools for programmable logic controllers PLCs, EcoStruxure Control Expert and EcoStruxure Process Expert, is related to insufficient protection of registration data. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the project...

The vulnerability of Acronis Cyber ​​Protect Cloud’s cloud-based data protection software lies in its authentication procedures, which allow attackers to gain unauthorized access to protected information.

The vulnerability of Acronis Cyber ​​Protect Cloud data protection software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to gain unauthorized access to protected information...

The vulnerability in the implementation of the Secure Boot protocol for operating systems with Windows, which allows attackers to circumvent existing security restrictions.

The vulnerability of the Secure Boot protocol for operating systems running Windows is related to a breach in the data protection mechanism. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions...

PT-2024-3723 · Oracle +1 · Oracle Graalvm Enterprise Edition +2

Name of the Vulnerable Software and Affected Versions: Oracle GraalVM for JDK versions 17.0.10, 21.0.2, 22 Oracle GraalVM Enterprise Edition versions 20.3.13, 21.3.9 Description: The issue is related to insufficient protection of internal data in the Compiler component of Oracle GraalVM for JDK a...

PT-2024-3198 · Oracle · Oracle Webcenter Portal

Name of the Vulnerable Software and Affected Versions: Oracle WebCenter Portal version 12.2.1.4.0 Description: The vulnerability in the Oracle WebCenter Portal product is related to insufficient protection of internal data. It allows a remote attacker to gain unauthorized access to read, add,...