USN-4754-4: Python 2.7 vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description USN-4754-1 fixed vulnerabilities in Python. Because of a regression, a subsequent update removed the fix for CVE-2021-3177. This update reinstates the security fix for CVE-2021-3177...

USN-4759-1: GLib vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Krzesimir Nowak discovered that GLib incorrectly handled certain large buffers. A remote attacker could use this issue to cause applications linked to GLib to crash, resulting in a...

Shanghai Zhenyun Information Technology Co., Ltd. SRM Integrated Digital Procurement Management Platform Has Logical Flaws and Vulnerabilities

SRM All-in-One Digital Procurement Management Platform is a self-contained and cloud-based deployment of an enterprise-class procurement management platform. A logic flaw exists in the SRM integrated digital procurement management platform of Shanghai Zhenyun Information Technology Co., Ltd. that...

First User Logon via Citrix Workspace App Since Command Line Deployment Receiving "Citrix Workspace is Setting up your store...”

Citrix Workspace app for Windows via Command Line and configured store URL in the process. During first user logon via Workspace App since reboot the following dialog is displayed"Citrix Workspace is setting up your store. this process will take few minutes”...

USN-4761-1: Git vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Matheus Tavares discovered that Git incorrectly handled delay-capable clean/smudge filters when being used on case-insensitive filesystems. A remote attacker could possibly use this...

Unsupported license deployment alarm in Veeam Service Provider Console

Challenge Veeam Service Provider Console displays the alarm: Unsupported license deployment. Shared license key Copy The Alarm Description states: The same license ID has been detected for the backups servers: Copy Cause This alarm occurs when the same license is detected as having been installed...

Argo 信息泄露漏洞

Argo is an open source container native workflow engine. An information disclosure vulnerability exists in Argo CD versions prior to 1.8.4, which stems from the fact that accessing the endpoint api version discloses internal information about the system and the endpoint is not protected by...

Schneider Electric IGSS SCADA Software

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Schneider Electric Equipment: IGSS Interactive Graphical SCADA System Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of these...

InsightIDR’s NTA Capabilities Expanded to AWS

We’re excited to announce we have expanded the Network Traffic Analysis NTA capabilities in InsightIDR to support Amazon Web Services AWS environments. This means InsightIDR and MDR customers can now ingest detailed network data from AWS, including north/south and east/west traffic across a...

Microsoft Releases March 2021 Security Updates

Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s March 2021 Security Update Summary and...

Description of the security update for SharePoint Enterprise Server 2016: March 9, 2021 (KB4493199)

None None...

Description of the security update for SharePoint Server 2010: March 9, 2021 (KB3101541)

Description of the security update for SharePoint Server 2010: March 9, 2021 KB3101541 Summary This security update resolves a Microsoft SharePoint Server Remote Code Execution Vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2021-27076...

Description of the security update for PowerPoint 2016: March 9, 2021 (KB4493224)

None None...

Description of the security update for SharePoint Enterprise Server 2016: March 9, 2021 (KB4493232)

None None...

Description of the security update for Office 2010: March 9, 2021 (KB4493214)

Description of the security update for Office 2010: March 9, 2021 KB4493214 Summary This security update resolves a Microsoft Excel Remote Code Execution Vulnerability. To learn more about the vulnerability, see the following security advisories: Microsoft Common Vulnerabilities and Exposures...

Sensor Architecture Can Help Keep Us Up and Running: Part 2

Previously, I introduced the field of sensor systems architecture and posed a real world example scenario of the unnecessary resource costs and hazards that can happen when the deployment of sensors isn't carefully thought out...

USN-4158-1: LibTIFF vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that LibTIFF incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image, a remote attacker cou...

USN-4602-1: Perl vulnerabilities | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description ManhND discovered that Perl incorrectly handled certain regular expressions. In environments where untrusted regular expressions are evaluated, a remote attacker could possibly use thi...

How to Keep Up With Vulnerability Management Challenges in Ephemeral Cloud Environments

This blog is part of an ongoing series sharing key takeaways from Rapid7’s 2020 Cloud Security Executive Summit. Interested in participating in the next summit on March 9? Register here! The modern perspective is that the cloud has made it much easier to have visibility of your attack surface and...

Gradle 日志信息泄露漏洞

Gradle is a set of JVM-based project building tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A log message disclosure vulnerability exists in the Gradle plugin's com.bmuschko:gradle-vagrant-plugin. When this Gradle plugin is executed in a public CI/CD, it results in the...