ipa security and bug fix update

4.6.8-5.0.1 - Blank out header-logo.png product-name.png - Replace login-screen-logo.png Orabug: 20362818 4.6.8-5.el79.4 - Resolves: 1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing - wgi/plugins.py: ignore empty plugin directories - Resolves: 1895197...

[Webinar] Oy Vey, We Hired a Large, Hairy Hacker…

It's not every day that one of the best-known independent cybersecurity individuals joins a cybersecurity company. The two are generally on opposite sides of the coin, with little crossover. After all, they're usually concerned with different parts of the cybersecurity puzzle – one providing...

Information Disclosure

highcharts-export-server is vulnerable to information disclosure. If the export server is accessible via internet, it allows reading of internal HTTP resources and outputting files served by other services on the internal network in which the export server is hosted...

The vulnerability of the Audio component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Audio component in the Google Chrome browser is related to its use after release. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially crafted web page...

The vulnerability of Google Chrome’s WebAudio component allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebAudio component in the Google Chrome browser is related to buffer overflows in the queue. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the OpenJPEG library for image encoding and decoding, which arises due to insufficient validation of input data, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the src/lib/openjp2/t2.c file of the OpenJPEG image encoding and decoding library exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

QCubed 3.1.1 PHP Object Injection Vulnerability

QCubed PHP Object Injection =========================== | Target: | QCubed Framework | | Vendor: | QCubed | | Version: | all versions including 3.1.1 | | CVE: | CVE-2020-24914 | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagner AIT Austrian Institute of Technolog...

QCubed 3.1.1 Cross Site Scripting Vulnerability

QCube Cross-Site-Scripting ====================== | Target: | QCubed Framework | | Vendor: | QCubed | | Version: | all versions including 3.1.1 | | CVE: | CVE-2020-24912 | | Accessibility: | Remote | | Severity: | High | | Author: | Wolfgang Hotwagner AIT Austrian Institute of Technology | SUMMAR...

CVE-2021-24031

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions matching the input would only be set at completion time. Output files could therefore be readable or writable to unintended parties...

The vulnerability of Google Chrome’s browser extensions allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Google Chrome’s browser extensions is related to writing beyond the buffer. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerabilities of the 3D model rendering software programs Luxion KeyShot, Luxion KeyShot Viewer, Luxion KeyShot Network Rendering, and Luxion KeyVR are related to insufficient warnings about dangerous actions. Exploiting these vulnerabilities can allow attackers to compromise the...

Denial Of Service (DoS)

Linux Kernel is vulnerable to denial of service DoS. The vulnerability is possible because of an issue was discovered in drivers/accessibility/speakup/spkttyio.c. Local attackers on systems with the speakup driver could cause a local denial of service attack, aka CID-d41227544427. This occurs...

The vulnerability of the USB DeviceHandler component in the Google Chrome web browser allows a perpetrator to compromise the integrity, confidentiality, and accessibility of the protected information.

The vulnerability of the USB DeviceHandler component in the Google Chrome web browser is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the integrity, confidentiality, and accessibility of the protected...

The vulnerability of the org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory component in the Jackson-databind library of the FasterXML project allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory component in the Jackson-databind library of the FasterXML project is related to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the org.apache.commons_proxy_provider.remoting.RmiProvider component in the Jackson-databind library of the FasterXML project allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the org.apache.commonsproxyprovider.remoting.RmiProvider component in the Jackson-databind library of the FasterXML project is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality,...

The vulnerability of the org.apache.activemq component in the Jackson-databind library of the FasterXML project allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the org.apache.activemq component in the Jackson-databind library of the FasterXML project relates to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protect...

The vulnerability of the org.aoju.busproxy.provider.remoting.RmiProvider component in the Jackson-databind library of the FasterXML project allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the org.aoju.busproxy.provider.remoting.RmiProvider component in the Jackson-databind library of the FasterXML project is related to the restoration of unreliable data in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

The vulnerability of web services in the Spring Framework software platform allows attackers to compromise the confidentiality, integrity, and accessibility of information.

The vulnerability of web services in the Spring Framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of information...

LodaRAT Windows Malware Now Also Targets Android Devices

A previously known Windows remote access Trojan RAT with credential-stealing capabilities has now expanded its scope to set its sights on users of Android devices to further the attacker's espionage motives. "The developers of LodaRAT have added Android as a targeted platform," Cisco Talos...

The vulnerability of the Installation component of the Oracle Business Intelligence Enterprise Edition software platform allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Installation component of the Oracle Business Intelligence Enterprise Edition software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected...