Security Bulletin: IBM Security SOAR is using components with multiple known vulnerabilities (CVE-2024-21094, CVE-2024-21085, CVE-2024-21011, CVE-2023-38264)

Summary IBM Security SOAR uses an older version of Java that may be identified and exploited. An update has been released which addresses these issues. It is recommended that customers upgrade to Version 51.0.2.2 or later of IBM Security SOAR. AppHost users should upgrade to version 1.15.2.1 or...

Heap-based Buffer Overflow

fiona is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to improper handling of long filenames, comments, or extra fields in within zlib components that contain integer overflow vulnerabilities, which can result in an application crash or potential code execution...

Ubuntu: Security Advisory (USN-6530-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS : HAProxy vulnerability (USN-6530-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6530-2 advisory. Seth Manesse and Paul Plasil discovered that HAProxy incorrectly handled URI components containing the hash character . A remote attacker could possib...

ALSA-2024:4757 Moderate: libvirt security update

Kernel-based Virtual Machine KVM offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the...

TP-Link Wi-Fi Router Command Execution

The vulnerability of TP-Link Wi-Fi routers such as Archer AX3000, Archer AXE75, Archer AX5400, Archer Air R5, and Archer AXE5400 exists due to the lack of measures taken to neutralize specific components used in the operating system. Exploiting this vulnerability allows a remote attacker to execu...

elice-backend-components (>=18.10.4.0, <=18.11.3.0) potentially affected by CVE-2024-40647 via sentry-sdk (0.4.3)

sentry-sdk PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - elice-backend-components =18.10.4.0, =18.11.3.0 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...

CVE-2024-21122

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Text Catalog. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HC...

CVE-2024-21122

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Text Catalog. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HC...

CVE-2024-21122

The CVE-2024-21122 entry affects Oracle PeopleSoft 9.2, specifically the Text Catalog in PeopleSoft Enterprise HCM Shared Components. The Root Cause is insufficient input validation in the Text Catalog component, enabling a low-privileged attacker with network access via HTTP to compromise the co...

CVE-2024-21122: Incorrect Default Permissions

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Text Catalog. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HC...

RLSA-2024:4351 Low: virt:rhel and virt-devel:rhel security and bug fix update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

XenMobile 10 Logs Collection Guide

This article illustrates the log collection process on devices such as iOS, Android and Windows Phone for the various XenMobile components including - App Controller, NetScaler Gateway, XenMobile Device Manager and Citrix Secure Hub. For the latest information on logcollection process refer to...

ROS-20240709-01

Vulnerability of the function UnicodeString::doAppend unistr.cpp of the International Components for Unicode library is related to integer overflow of the data structure. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to sensitive data, cause...

decode-uri-component decoder Heap Buffer Overflow DoS

The vulnerability of the decodeComponents function in the decode-uri-component decoder is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Johnson Controls Illustra Pro Gen 4 Security Vulnerability

Johnson Controls Illustra Pro Gen 4 is a series of surveillance probes from Johnson Controls, Inc. A security vulnerability exists in Johnson Controls Illustra Pro Gen 4 Camera SS016.05.03.01.0010 and prior versions, which stems from a dependency on vulnerable third-party components...

CVE-2024-26279

The wrapper extensions do not correctly validate inputs, leading to XSS vectors...

CVE-2024-26279

CVE-2024-26279 concerns Joomla! core wrapper extensions where inputs are not properly validated, enabling cross-site scripting (XSS) vectors. The NVD entry assigns a CVSSv3.1 base score of 6.1 (Medium) with Network attack vector, Low attack complexity, and user interaction required. Other connect...

CVE-2024-26279 [20240704] - Core - XSS in Wrapper extensions

The wrapper extensions do not correctly validate inputs, leading to XSS vectors...

HUMINT: Diving Deep into the Dark Web

Discover how cybercriminals behave in Dark Web forums- what services they buy and sell, what motivates them, and even how they scam each other. Clear Web vs. Deep Web vs. Dark Web Threat intelligence professionals divide the internet into three main components: Clear Web - Web assets that can be...