Security Bulletin: IBM Kenexa LCMS Premier On Premise - CVE-2021-2341 (deferred from Oracle Jul 2021 CPU for Java 7.x)

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE related to the Networking...

PT-2021-6485 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.0 and later Description: The issue is related to the ability of an unauthorized user to insert metadata when creating a new issue. This allows a remote attacker to impact data integrity. Recommendations: For GitLab...

GitLab 跨站脚本漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to view a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab, whic...

GitLab 跨站脚本漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab CE ...

Apple tvOS 权限许可和访问控制问题漏洞

Apple tvOS is a smart TV operating system from Apple. The tvOS vulnerability is a permission and access control issue that arises from improper privilege management in the kernel subsystem of the operating system. A local attacker could use kernel privileges to execute arbitrary code on the syste...

CVE-2020-29595

PlugIns\IDEACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV starting at IDEACDStd!JPEGTransW+0x00000000000031aa...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - [All] jQuery (Publicly disclosed vulnerability) CVE-2020-11023, CVE-2020-11022

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper...

Microsoft Access 2010 Service Pack 2 Remote Code Execution Vulnerability (KB4484385)

This host is missing an important security update according to Microsoft KB4484385. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - CVE-2019-2949 (deferred from Oracle Oct 2019 CPU)

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier 14.0 version. Vulnerability Details CVEID: CVE-2019-2949 DESCRIPTION: An unspecified vulnerability in Java SE related to the Kerberos componen...

Security Bulletin: IBM Kenexa LCMS Premier On Premise - IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU

Summary We have identified that the IBM Kenexa LCMS Premier is affected by one or more security vulnerabilities. These have been addressed in LCMS Premier version 14.0 Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0...

Siemens SINEMA Server

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SINEMA Server Vulnerability: Incorrect Privilege Assignment 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker with a valid session, with...

CVE-2019-1588 Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Arbitrary File Read Vulnerability

A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure ACI mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms o...

CVE-2019-1588

A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure ACI mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms o...

MicroWorld Technologies eScan eScan Agent Application Access Control Error Vulnerability

MicroWorld Technologies eScan is a suite of antivirus software from MicroWorld, USA. It protects against spyware, malware, spam, etc. eScan Agent Application MWAGENT.EXE is one of the agent-side applications. An Access Control Error vulnerability exists in eScan Agent Application MWAGENT.EXE...

Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openssh (SSA:2018-067-01)

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and 14.2 to fix a security issue. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-067-01. The text itself is copyright C...

[slackware-security] gnupg

New gnupg packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/gnupg-1.4.22-i586-1slack14.2.txz: Upgraded. Mitigate a flush+reload side-channel attack on RSA secret...

[slackware-security] bind

New bind packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/bind-9.9.1P4-i486-1slack14.0.txz: Upgraded. This update fixes a security issue where a certain...

MozillaThunderbird: update to Thunderbird 14.0 (important)

Mozilla Thunderbird was updated to version 14.0 bnc771583 MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-2012-1 952 Gecko memory corruption MFSA 2012-45/CVE-2012-1955 bmo757376 Spoofing issue with location MF...

Новые уязвимости в Cetera eCommerce

Здравствуйте 3APA3A! Сообщаю вам о найденных мною новых Cross-Site Scripting и SQL DB Structure Extraction уязвимостях в Cetera eCommerce. XSS WASC-08: http://site/cms/templates/banner.php?bannerId=3Cscript3Ealertdocument.cookie3C/script3E SQL DB Structure Extraction WASC-13:...

Cetera eCommerce - 'banner.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45374/info Cetera eCommerce is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...