Elasticsearch 7.13.4 Security Update

Elasticsearch memory disclosure issue ESA-2021-16 A memory disclosure vulnerability was identified in Elasticsearch’s error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing...

Oracle Hospitality Reporting and Analytics输入验证错误漏洞

Oracle Hospitality Reporting and Analytics is a web-based application that centralizes point-of-sale POS data, provides operational and analytical insight into business operations, and improves efficiency by delivering information to all roles within the organization. and Analytics version 9.1.0...

Elastic 安全漏洞

Elastic is the Netherlands Elastic company's set of open source distributed RESTful search engine built on Lucene . The product is mainly used in cloud computing and supports data indexing using JSON over HTTP. A security vulnerability exists in Elastic search.Elastic Elastic search may allow a...

Oracle Fusion Middleware 输入验证错误漏洞

Oracle BI Publisher is a reporting solution that makes it easier and faster to produce, manage, and deliver all reports and documents than traditional reporting tools.Oracle BI Publisher versions 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0 of the E- Business Suite - XDO component contains a...

Linux-Focused Cryptojacking Gang Tracked to Romania

A cryptojacking gang that’s likely based in Romania is using a never-before-seen SSH brute-forcer dubbed “Diicot brute” to crack passwords on Linux-based machines with weak passwords. The point of the campaign is mainly to deploy Monero mining malware, Bitdefender researchers said in a report...

Design/Logic Flaw

Under certain conditions, SAP Business Objects Web Intelligence BI Launchpad versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted...

CVE-2021-33667

CVE-2021-33667 affects SAP Business Objects Web Intelligence (BI Launchpad) versions 420 and 430. Affected component is the frontend Analytical Reporting bundle accessed via SDK calls, where an attacker could access JSP source code that would normally be restricted, resulting in information discl...

CVE-2021-33667

Under certain conditions, SAP Business Objects Web Intelligence BI Launchpad versions - 420, 430, allows an attacker to access jsp source code, through SDK calls, of Analytical Reporting bundle, a part of the frontend application, which would otherwise be restricted...

Tianjin Shenzhou Haotian Technology Co., Ltd. online self-service accounting system has logic flaws vulnerability

Tianjin Shenzhou Haotian Technology Co., Ltd. is a high-tech enterprise integrating management software design, development, sales and service. Tianjin Shenzhou Haotian Technology Co., Ltd. online self-service reporting system has a logic flaw vulnerability, attackers can use the vulnerability to...

What's New in InsightIDR: Q2 2021 in Review

This year, we’re focusing on providing customers with more extensibility and customization in InsightIDR — from adding new event sources to completely refreshing our Dashboard and Reporting experience, we’ve made some strides over the last few months. This post offers a closer look at some of the...

CVE-2021-34624

creationtimestamp| type| source ---|---|--- 2021-07-05 12:18:01+00:00| seen| https://t.me/CyberSecurityTechnologies/3770 2021-07-07 16:37:45+00:00| seen| https://t.me/cibsecurity/25961 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-05-10...

Security Bulletin: Security vulnerability in IBM® Java SDK April 2021 CPU has been identified in Jazz Team Server shipped with Jazz Reporting Service

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about a security vulnerability in IBM® SDK Java Technology Edition from April 2021 CPU that is affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability...

Why MTTR is Bad for SecOps

Mean time to resolution MTTR is a commonly used metric in the security industry. While it has utility to a business’s risk function, it does not belong in security operations SecOps. First, let us level-set on what reporting is versus metrics. Reporting measures activity and does not drive specif...

Wrong price scale for GasOracle

Handle cmichel Vulnerability details The GasOracle uses two chainlink oracles GAS in ETH with some decimals, USD per ETH with some decimals and multiplies their raw return values to get the gas price in USD. However, the scaling depends on the underlying decimals of the two oracles and could be...

com.beirtipol:jfixtools-reporting (=1.0-BETA), com.beirtipol:jfixtools-ui-vaadin (=1.0-BETA) +109 more potentially affected by CVE-2021-33604 via com.vaadin:flow-server (>=3.0.0 <=6.0.1)

com.vaadin:flow-server MAVEN version =3.0.0, =1.1.6, =15.0.0, =15.0.0, =0.17.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =5.0.0, =6.0.1 and more Source cves: CVE-2021-33604 Source advisory: OSV:GHSA-8VFW-V2JV-9HWC...

Mythic - A Collaborative, Multi-Platform, Red Teaming Framework

A cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming. Details Check out a series of YouTube videos...

BadgerYieldSource balanceOfToken share calculation seems wrong

Handle cmichel Vulnerability details When suppling to the BadgerYieldSource, some amount of badger is deposited to badgerSett and one receives badgerSett share tokens in return which are stored in the balances mapping of the user. So far this is correct. The balanceOfToken function should then...

Security Bulletin: A Security Vulnerability in IBM Java Runtime affect IBM License Key Server Administration and Reporting Tool and its Agent

Summary A security vulnerability has been found in the IBM® Runtime Environment Java™ used by IBM License Key Server Administration and Reporting Tool and its Agent. A fix has been published to mitigate the same. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerabilit...

Security Bulletin: IBM Tivoli Common Reporting: TCR, a part of IBM Jazz for Service Management (JazzSM) is vulnerable to a Directory Traversal vulnerability (CVE-2020-5016)

Summary WebSphere Application Server is vulnerable to a directory traversal vulnerability. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM Tivoli Common...

GHSA-52QP-GWWH-QRG4 Missing Handler in @scandipwa/magento-scripts

Impact After changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec and logs commands, effectively making them unusable. Patches Version 1.5.3 contains patches for the problems described above. Workarounds Upgrade to patched or latest...