PT-2020-4487

Name of the Vulnerable Software and Affected Versions Java SE versions 11.0.8 through 15 Description The issue is related to insufficient input validation in the Libraries component of Java SE, allowing an unauthenticated attacker with network access via multiple protocols to compromise Java SE...

PT-2020-4502

Name of the Vulnerable Software and Affected Versions Java SE versions 7u271, 8u261, 11.0.8, and 15 Java SE Embedded version 8u261 Description The issue is related to insufficient input validation in the Libraries component of Java SE and Java SE Embedded, allowing an unauthenticated attacker wit...

Overlay Malware Targets Windows Users with a DLL Hijack Twist

Brazilians are being warned of a new overlay malware targeting Windows users in order to siphon victims’ financial data and drain their bank accounts. Researchers say what the malware, dubbed Vizom, lacks in sophistication it makes up for in its creative abuse of the Windows ecosystem. Trusteer, ...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Version 8.0 used by IBM MessageGateway These issues were disclosed as part of the IBM Java SDK updates in Month, Year. Vulnerability Details CVEID: CVE-2020-14556 DESCRIPTION: An unspecified vulnerability in Java SE relate...

openSUSE Security Update : gcc10 / nvptx-tools (openSUSE-2020-1693)

This update for gcc10, nvptx-tools fixes the following issues : This update provides the GCC10 compiler suite and runtime libraries. The base SUSE Linux Enterprise libraries libgccs1, libstdc++6 are replaced by the gcc10 variants. The new compiler variants are available with '-10' suffix, you can...

OPENSUSE-SU-2020:1692-1 Security update for gcc10, nvptx-tools

This update for gcc10, nvptx-tools fixes the following issues: This update provides the GCC10 compiler suite and runtime libraries. The base SUSE Linux Enterprise libraries libgccs1, libstdc++6 are replaced by the gcc10 variants. The new compiler variants are available with '-10' suffix, you can...

Security update for gcc10, nvptx-tools (moderate)

openSUSE Security Update: Security update for gcc10, nvptx-tools Announcement ID: openSUSE-SU-2020:1693-1 Rating: moderate References: 1172798 1172846 1173972 1174753 1174817 1175168 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability and...

Security update for gcc10, nvptx-tools (moderate)

openSUSE Security Update: Security update for gcc10, nvptx-tools Announcement ID: openSUSE-SU-2020:1692-1 Rating: moderate References: 1172798 1172846 1173972 1174753 1174817 1175168 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Netcool Agile Service Manager

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Netcool Agile Service Manager. IBM Netcool Agile Service Manager has addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates in June 2020. Vulnerability Detail...

CVE-2020-15224 Socket syscalls can leak enclave memory contents in Open Enclave

In Open Enclave before version 0.12.0, an information disclosure vulnerability exists when an enclave application using the syscalls provided by the sockets.edl is loaded by a malicious host application. An attacker who successfully exploited the vulnerability could read privileged data from the...

The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client software allows a perpetrator to execute arbitrary code.

The vulnerability of the process-interaction channel of the Cisco AnyConnect Secure Mobility Client software-related client software is related to errors in the mechanism for checking the path to dynamically attached libraries. Exploiting this vulnerability can allow an attacker to execute...

Akamai and Snyk Partnership Creates a Powerful Combination for In-Browser Script Protection

A web experience begins with the sum of the code you created. But it also includes all the code the user is put in contact with when loading your website. This means the attack surface to monitor for web application software threats is not just your code repositories, but the sum of the assets re...

Uber: RCE via npm misconfig -- installing internal libraries from the public registry

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affecting Rational Functional Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8.0.6.15 used by Rational Functional Tester RFT versions 8.6.0.7 - 9.5. RFT has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14583 DESCRIPTION: An unspecified vulnerability in Java SE...

SwiftBelt - A macOS Enumeration Tool Inspired By Harmjoy'S Windows-based Seatbelt Enumeration Tool

SwiftBelt is a macOS enumerator inspired by @harmjoy's Windows-based Seatbelt enumeration tool. SwiftBelt does not utilize any command line utilities and instead uses Swift code leveraging the Cocoa Framework, Foundation libraries, OSAKit libraries, etc. to perform system enumeration. This can be...

The vulnerability of the software for working with animations in Adobe Character Animator lies in errors during the path validation of dynamically loaded libraries, allowing attackers to execute arbitrary code.

The vulnerability of the software for working with animations in Adobe Character Animator is related to errors in checking the path of dynamically loaded libraries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11.

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, used by IBM Integration Bus & IBM App Connect Enterprise v11. These issues were disclosed as part of the IBM Java SDK updates in July 2020 Vulnerability Details CVEID: CVE-2020-14621 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 1.8 and IBM Runtime Environment Java Version 1.8 used by Rational Performance Tester. Rational Performance Tester has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An...

CVE-2017-10388

It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the-middle attacker could possibly use this flaw to impersonate Kerberos services to Java...

[SECURITY] Fedora 33 Update: dotnet3.1-3.1.108-1.fc33

.NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of...