Oracle Linux 8 : java-17-openjdk (ELSA-2023-5751)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5751 advisory. - OpenJDK: memory corruption issue on x8664 with AVX-512 JDK-8317121 CVE-2023-22025 - OpenJDK: certificate path validation issue during client...

Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords...

CVE-2023-31417 Elasticsearch Insertion of sensitive information in audit logs

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords...

CVE-2023-31417

CVE-2023-31417 affects Elasticsearch where the existing audit-filtering logic fails to mask sensitive data when clients use deprecated API URIs. The consequence is that passwords and tokens could be printed in cleartext in Elasticsearch audit logs. The description notes that audit logging is disa...

Qualys Named a Leader in KuppingerCole CSPM Report

Cloud Security Posture Management CSPM is a crucial requirement in cloud security. CSPM is all about identifying misconfiguration issues and compliance risks in cloud environments. Since cloud misconfigurations are the leading cause of data breaches, you want an excellent CSPM solution on your...

Vulnerabilities fixed in Oracle Financial Services Applications

Vulnerabilities have been fixed in Oracle Financial Services Applications products. A malicious party could exploit them to launch attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Accessing sensitive data Oracle has...

Important: Red Hat Security Advisory: virt:rhel security update

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated thi...

Yifan YF325 httpd next_page buffer overflow vulnerability

Talos Vulnerability Report TALOS-2023-1761 Yifan YF325 httpd nextpage buffer overflow vulnerability October 11, 2023 CVE Number CVE-2023-35055,CVE-2023-35056 SUMMARY A buffer overflow vulnerability exists in the httpd nextpage functionality of Yifan YF325 v1.020221108. A specially crafted network...

.NET 7.0 security, bug fix, and enhancement update

An update is available for dotnet7.0. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list .NET is a managed-software framework. It implements a subset of the .NET...

Exploit for Out-of-bounds Write in Webmproject Libvpx

CVE-2023-5217: libvpx VP8 Encoding Heap Overflow PoC CVE-2023...

API Security Trends 2023 – Have Organizations Improved their Security Posture?

APIs, also known as application programming interfaces, serve as the backbone of modern software applications, enabling seamless communication and data exchange between different systems and platforms. They provide developers with an interface to interact with external services, allowing them to...

Denial Of Service (DoS)

firefox-esr is vulnerable to Denial Of Service DoS. The vulnerability arises from out-of-bounds memory access via WebGL APIs, resulting in memory corruption and a potentially exploitable crash. This bug only affects Firefox and Thunderbird for macOS...

APIs: Unveiling the Silent Killer of Cyber Security Risk Across Industries

Introduction In today's interconnected digital ecosystem, Application Programming Interfaces APIs play a pivotal role in enabling seamless communication and data exchange between various software applications and systems. APIs act as bridges, facilitating the sharing of information and...

CVE-2023-20252

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...

CVE-2023-41904

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

Authentication flaw

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

JumpServer Security Vulnerability

Jumpserver is an open source bastion machine from Hangzhou Feizhiyun Information Technology Co. in China. JumpServer suffers from a security vulnerability that stems from the fact that it is possible to authenticate to the core APIs using a username and SSH public key, without the need for a...

CVE-2023-41904

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

CVE-2023-41904

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

CVE-2023-41904

CVE-2023-41904 affects Zoho ManageEngine ADManager Plus prior to version 7203, where the REST APIs suffer a 2FA bypass in AuthToken generation. This enables unauthorized access via REST endpoints, per multiple sources. Remediation is to upgrade to version 7203 or later; as a temporary measure, re...