PT-2021-23227 · Minio · Minio

Name of the Vulnerable Software and Affected Versions: Minio console versions prior to 0.12.3 Description: The Minio console is subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. This issue affects all users on release v0.12.2 and before. The...

Kubernetes: Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose"

Report Submission Form Summary: Kubernetes have a github project github.com/kubernetes/kompose In the project there is a doc which have installation steps In the steps, doc is referring to another github account repository to clone it and install. But the github account was not registered on...

The vulnerability of the deployment application for the QUSBCam2 monitoring system arises from the operation that goes beyond the buffer in memory, allowing a intruder to execute arbitrary code.

The vulnerability of the deployment application for the QUSBCam2 monitoring system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

tCell by Rapid7 Supports the Newly Released .NET 6.0

We’re excited to share that we've coordinated our recent .NET and .NET Core agent releases with the brand new .NET 6.0 release from Microsoft. What is tCell? Since the founding of tCell by Rapid7, our web application and API protection solution, we’ve prided ourselves on providing both breadth an...

The vulnerability of the Wi-Fi Aruba Instant deployment application, related to the operation that occurs outside the buffer in memory, allows a perpetrator to execute arbitrary code.

The vulnerability of the Wi-Fi Aruba Instant deployment application relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted packets to port 8211, using the Protocol Applicatio...

Description of the security update for Excel 2013: November 9, 2021 (KB5002072)

Description of the security update for Excel 2013: November 9, 2021 KB5002072 Summary This security update resolves a Microsoft Excel remote code execution vulnerability and Microsoft Excel security feature bypass vulnerability. To learn more about the vulnerabilities, see the following security...

Description of the security update for Office 2016: November 9, 2021 (KB5002032)

None None...

Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus

Microsoft has detected exploits being used to compromise systems running the ZOHO ManageEngine ADSelfService Plus software versions vulnerable to CVE-2021-40539 in a targeted campaign. Microsoft Threat Intelligence Center MSTIC attributes this campaign with high confidence to DEV-0322, a group...

Microsoft Releases November 2021 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s November 2021 Security Update Summary and Deploymen...

OSIsoft PI Vision

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: OSIsoft Equipment: PI Vision Vulnerabilities: Cross-site Scripting, Incorrect Authorization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to information disclosure,...

openSUSE 15 Security Update : java-1_8_0-openj9 (openSUSE-SU-2021:3615-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3615-1 advisory. - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Support...

[SECURITY] Fedora 33 Update: ansible-2.9.27-1.fc33

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

VISAM VBASE Editor

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely/low attack complexity Vendor: VISAM Equipment: VBASE Vulnerabilities: Improper Access Control, Cross-site Scripting, Improper Restriction of XML External Entity Reference, Using Components with Known Vulnerabilities 2. RISK...

Security Bulletin: Vulnerability in Oracle, Java SE Affecting Watson Speech Services

Summary A vulnerability in Oracle Java SE, within RedHat, affecting Watson Speech Services has been resolved. Vulnerability Details CVEID: CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE related to the Networking component could allow an unauthenticated attacker to obtain...

A Matter of Perspective: Agent-Based and Agentless Approaches to Cloud Security, Part 2

In our previous blog on this topic, we discussed some of the considerations when choosing between agent-based and agentless cloud security approaches. The following table provides a summary of these considerations. Aspect | Agent-based | Agentless ---|---|--- Deployment | - Deployed on every asse...

OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows...

Acronis: XSS in Acronis Cloud Manager Admin Portal

Hello, Hope you are doing well. I wanted to report the following security vulnerability: The Acronis Cloud Manager Admin Portal default swagger UI is vulnerable to cross site scripting. I have the API running locally on my machine. I have attached screenshots of the XSS The URL is:...

What Is API Management ❓ All That Novices To Experts Should Learn

The world of mobile and web app development revolves around API or Application Programming Interface. It’s a magic wand using which an application developer lets the applications correspond with each other. While you’re dealing with API, gaining acquaintances with API management operations, tools...

USN-5094-1: Linux kernel vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Several security issues were fixed in the Linux kernel. CVEs contained in this USN include: CVE-2021-22543, CVE-2021-3679, CVE-2021-37576, CVE-2021-38204, CVE-2021-38205,...

USN-5093-1: Vim vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Several security issues were fixed in Vim. CVEs contained in this USN include: CVE-2021-3770, CVE-2021-3778, CVE-2021-3796. Affected Cloud Foundry Products and Versions Severity is...