Adobe Releases Security Updates for Multiple Products

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Adobe’s Security Bulletins and apply the necessary updates...

Malicious Firefox Add-ons Block Browser From Downloading Security Updates

Mozilla on Monday disclosed it blocked two malicious Firefox add-ons installed by 455,000 users that were found misusing the Proxy API to impede downloading updates to the browser. The two extensions in question, named Bypass and Bypass XM, "interfered with Firefox in a way that prevented users w...

About the security content of iOS 14.8.1 and iPadOS 14.8.1

About the security content of iOS 14.8.1 and iPadOS 14.8.1 This document describes the security content of iOS 14.8.1 and iPadOS 14.8.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Vulnerability fixed in Discourse

A vulnerability has been fixed in Discourse. A unauthenticated remote malicious person could potentially potentially exploit it to execute arbitrary code under the rights of the application. To do so, malicious network traffic should be be sent to the /webhooks/aws endpoint. The vulnerability is...

About the security content of macOS Monterey 12.0.1

About the security content of macOS Monterey 12.0.1 This document describes the security content of macOS Monterey 12.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of iOS 15.1 and iPadOS 15.1

About the security content of iOS 15.1 and iPadOS 15.1 This document describes the security content of iOS 15.1 and iPadOS 15.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

MGASA-2021-0485 Updated tomcat packages fix security vulnerability

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. CVE-2021-30640 Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not...

Cisco Releases Security Updates for IOS XE SD-WAN Software

Cisco has released security updates to address a vulnerability in IOS XE SD-WAN Software. An authenticated local attacker could exploit this vulnerability to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA...

openSUSE 15 Security Update : python (openSUSE-SU-2021:3489-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3489-1 advisory. - Denial of service when identifying crafted invalid RFCs fedora-all CVE-2021-3733 - client can enter an infinite loop on a 100 Continue...

RHEL 8 : curl (RHSA-2021:3903)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3903 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

Microsoft Security Update Validation Report October 2021

Microsoft’s October 2021 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwar...

Security Updates for Microsoft Dynamics 365 (on-premises) (Oct 2021)

The Microsoft Dynamics 365 on-premises installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A spoofing vulnerability CVE-2021-41353 - A cross-site scripting vulnerability CVE-2021-41354 Note that Nessus has not tested for these...

Security Updates for Exchange (October 2021)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-264...

Security Updates for Microsoft Office Web Apps (October 2021)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Security Updates for Microsoft System Center Operations Manager (October 2021)

The version of Microsoft System Center Operations Manager installed on the remote Windows host is affected by an information disclosure vulnerability. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to an affected SCOM instance in order to...

Juniper Networks Releases Security Updates for Multiple Products

Juniper Networks has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Juniper Networks security advisories page an...

Vulnerabilities fixed in Foxit products

Vulnerabilities have been fixed in Foxit products. The vulnerabilities allow a malicious person to carry out attacks that lead to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Access to system data Foxit has released updates to fix the vulnerabilitie...

Security Updates for Microsoft Office (October 2021) (macOS)

The Microsoft Office product installed on the remote host is affected by multiple vulnerabilities, as follows: - An information disclosure vulnerability in rich text editing that can be exploited by a low privileged, local user. CVE-2021-40454 - Remote code execution vulnerabilities in Excel that...

RHEL 8 : httpd:2.4 (RHSA-2021:3816)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3816 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: modproxy: SSRF v...

RHEL 7 : kpatch-patch (RHSA-2021:3768)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3768 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...