Security Advisory 0066

Security Advisory 0066 . CSAF PDF Date: August 20th, 2021 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2021 | Initial Release The CVE-ID tracking this issue: CVE-2021-28495 CVSSv3.1 Base Score: 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L Description This advisory...

Security Advisory 0065

Security Advisory 0065 . CSAF PDF Date: August 20th, 2021 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2021 | Initial Release The CVE-ID tracking this issue: CVE-2021-28497 CVSSv3.1 Base Score: 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Description This advisory...

Security Advisory 0064

Security Advisory 0064 . CSAF PDF Date: August 20th, 2021 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2021 | Initial Release The CVE-ID tracking this issue: CVE-2021-28498 CVSSv3.1 Base Score: 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H The CVE-ID tracking this issu...

APSB21-60 Security hotfix available for Adobe Captivate

Adobe has released a security hotfix for Adobe Captivate. This hotfix addresses an important vulnerability. Successful exploitation could lead to privilege escalation in the context of the current user...

PYSEC-2021-560

TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, tf.rawops.SparseTensorSliceDataset implementation can be made to dereference a null pointer. The implementation has some argument validation but fails...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 5 (7.5.1-742)

The Hotfix 5 for Virtuozzo Hybrid Server 7.5 Update 1 provides stability and usability bug fixes. Vulnerability id: PSBM-131042 OACI After upgrading the host from Virtuozzo Hybrid Server 7.0.14, virtual machines could fail to start due to incorrect firewall settings. Vulnerability id: PSBM-132009...

Cohesity Linux agent 安全漏洞

Cohesity Linux agent is used in different installer packages to provide support for multiple Linux distributions. A security vulnerability exists in Cohesity Linux agent, which stems from the product's lack of an effective privilege management mechanism. The vulnerability can be exploited to gain...

Hotfix XS82E030 - For Citrix Hypervisor 8.2

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. Information About this Hotfix Component| Details ---|--- Prerequisite| None Post-update tasks| Restart Host Content live patchable| Yes Baselines for Live Patch| XS82E024 Revision History| Published on J...

Outlook is unable to launch after Citrix UPM Hotfix ProfilemgtWX64_1912_3001 installation Error status 0xc0000428

After installing theCitrixHotfixProfilemgtWX6419123001, anerror is generated when opening Outlook: OUTLOOK.EXE : Bad Image C:\Program Files\Citrix\User Profile Manager\upmoutlookhook64.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the...

Serv-U FTP Server <= 15.2.3 Hotfix 1 Memory Escape Vulnerability

According to its banner, the installed version of Serv-U is a version prior to 15.2.3 Hotfix 2. It is, therefore, affected memory escape vulnerability. An unauthenticated remote attacker who successfully exploited this vulnerability could run arbitrary code with privileges, which could then insta...

CVE-2021-34552

A flaw was found in python-pillow. This flaw allows an attacker to pass controlled parameters directly into a convert function, triggering a buffer overflow in the "convert" or "ImagingConvertTransparent" functions in Convert.c. The highest threat to this vulnerability is to system availability. ...

SolarWinds Issues Hotfix for Zero-Day Flaw Under Active Attack

SolarWinds has issued a hotfix for a zero-day remote code execution RCE vulnerability already under active, yet limited, attack on some of the company’s customers. Microsoft alerted the company about the flaw, which affects its Serv-U Managed File Transfer Server and Serv-U Secured FTP products...

SolarWinds Serv-U FTP and Managed File Transfer CVE-2021-35211: What You Need to Know

On July 12, 2021, SolarWinds confirmed an actively exploited zero-day vulnerability, CVE-2021-35211, in the Serv-U FTP and Managed File Transfer component of SolarWinds15.2.3 HF1 released May 5, 2021 and all prior versions. Successful exploitation of CVE-2021-35211 could enable an attacker to gai...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 4 (7.5.1-739)

The Hotfix 4 for Virtuozzo Hybrid Server 7.5 Update 1 provides a stability and usability bug fix. Vulnerability id: PSBM-130698 Migrating a container from Virtuozzo 6 to Virtuozzo Hybrid Server 7 with the '--keep-src' option could result in duplicate UUIDs in 'prlctl list' output on the destinati...

Virtuozzo Hybrid Infrastructure 4.6 Hotfix 2 (4.6.0-213)

This update provides stability fixes for the storage, Backup Gateway and object storage services. Vulnerability id: VSTOR-44694 A stability fix for the storage service. Vulnerability id: VSTOR-44859 A stability fix for the Backup Gateway service. Vulnerability id: VSTOR-44677 Complete multipart...

Plone CMS 5.0.0 <= 5.2.4 XSS Vulnerability

Plone CMS is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

EC-CUBE fails to restrict access permissions

Overview EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions CWE-284 . EC-CUBE CO.,LTD. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and EC-CUBE CO.,LTD. coordinated under the Information Security Early Warning Partnership...

JVN#57942445: EC-CUBE fails to restrict access permissions

EC-CUBE provided by EC-CUBE CO.,LTD. fails to restrict access permissions CWE-284 . Impact A remote attacker may obtain sensitive information. Solution Update the Softwere Update the software according to the information provided by the developer. The developer has released EC-CUBE 4.0.6-p1 that...

Hotfix XS82E029 - For Citrix Hypervisor 8.2

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. Information About this Hotfix Component| Details ---|--- Prerequisite| None Post-update tasks| None Content live patchable| No Baselines for Live Patch| N/A Revision History| Published on Jun 28, 2021...

CVE-2021-25655

A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 without hotfix and 8.0.0 without hotfix...