Siemens Opcenter Intelligence

SUMMARY The Tableau Server component in Opcenter Intelligence contains multiple vulnerabilities as described below. Siemens has released a new version for Opcenter Intelligence and recommends to update to the latest version and to install the latest available version of Tableau Server as...

KB5051979: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (February 2025)

The remote Windows host is missing security update 5051979 or hotpatch 5052106. It is, therefore, affected by multiple vulnerabilities - Windows Routing and Remote Access Service RRAS Remote Code Execution Vulnerability CVE-2025-21208, CVE-2025-21410 - Windows Telephony Service Remote Code...

CVE-2022-29174

countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this...

Oracle WebLogic Server (January 2025 CPU)

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to...

Oracle MySQL Server 8.0.x < 8.0.41 (January 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.40 and prior, 8.4....

Oracle MySQL Server 9.x < 9.2.0 (January 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.40 and prior, 8.4....

PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack

A previously undocumented China-aligned advanced persistent threat APT group named PlushDaemon has been linked to a supply chain attack targeting a South Korean virtual private network VPN provider in 2023, according to new findings from ESET. "The attackers replaced the legitimate installer with...

PT-2025-4238 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the Server: Optimizer component of MySQL Server, which can be easily exploited by an...

PT-2025-4277 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the InnoDB component of MySQL Server, allowing an attacker with elevated privileges and...

PT-2024-10247 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

Mattermost Server 9.5.x < 9.5.13, 9.11.x < 9.11.5, 10.0.x < 10.0.3, 10.1.x < 10.1.3, 10.2.0 (MMSA-2024-00388, MMSA-2024-00392)

The version of Mattermost Server installed on the remote host is prior to 9.5.13, 9.11.5, 10.0.3, 10.1.3 or 10.2.0. It is, therefore, affected by the vulnerabilities as referenced in the MMSA-2024-00388 and MMSA-2024-00392 advisories: - Mattermost fails to prevent concurrently checking and updati...

GoPhish sends cleartext passwords

Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers...

USN-7143-1: RabbitMQ Server vulnerabilities

Christian Rellmann discovered that RabbitMQ Server did not properly sanitize user input when adding a new user via the management UI. An attacker could possibly use this issue to perform cross site scripting and obtain sensitive information. CVE-2021-32718 Fahimhusain Raydurg discovered that...

CVE-2024-12209

Summary (CVE-2024-12209): WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to 2.17.0 via the umbrella-restore action’s filename parameter. Unauthenticated attackers can include and execute arbitrary server files, enablin...

Devolutions Remote Desktop Manager Multiple Vulnerabilities (DEVO-2024-0016)

The remote installation of Devolutions Server is affected by the following vulnerabilities: - Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypass the View Password...

About Elevation of Privilege – needrestart (CVE-2024-48990) vulnerability

About Elevation of Privilege - needrestart CVE-2024-48990 vulnerability. On November 19, Qualys released a security bulletin about five privilege escalation vulnerabilities in the needrestart utility CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003 used in Ubuntu...

Improper Input Validation

mudler/LocalAI is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of automatic archive extraction, allowing a 'tarslip' attack to bypass file location restrictions and write files to arbitrary locations on the server...

RHEL 6 / 7 : rh-mysql56-mysql (RHSA-2018:1254)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1254 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon, mysqld, and many client programs. The...

virt:ol and virt-devel:rhel security update

hivex libguestfs libguestfs-winsupport libiscsi libnbd 1.6.0-6 - Fix CVE-2024-7383 NBD server improper certificate validation resolves: RHEL-52728 libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm 6.2.0-53 - kvm-nbd-server-Favor-qemuaiocontext-over-iohandler-con.patc...

Vulnerabilities fixed in Microsoft SQL Server

Microsoft has fixed vulnerabilities in SQL Server. Most of the vulnerabilities are in SQL Native Scoring and allow a malicious person to assign themselves elevated privileges, access sensitive data and execute arbitrary code within the SQL Server. Successful exploitation requires the malicious...