MGASA-2021-0485 Updated tomcat packages fix security vulnerability

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. CVE-2021-30640 Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not...

Cisco Releases Security Updates for IOS XE SD-WAN Software

Cisco has released security updates to address a vulnerability in IOS XE SD-WAN Software. An authenticated local attacker could exploit this vulnerability to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA...

openSUSE 15 Security Update : python (openSUSE-SU-2021:3489-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3489-1 advisory. - Denial of service when identifying crafted invalid RFCs fedora-all CVE-2021-3733 - client can enter an infinite loop on a 100 Continue...

RHEL 8 : curl (RHSA-2021:3903)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3903 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

Microsoft Security Update Validation Report October 2021

Microsoft’s October 2021 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwar...

Security Updates for Microsoft Dynamics 365 (on-premises) (Oct 2021)

The Microsoft Dynamics 365 on-premises installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A spoofing vulnerability CVE-2021-41353 - A cross-site scripting vulnerability CVE-2021-41354 Note that Nessus has not tested for these...

Security Updates for Microsoft Office Web Apps (October 2021)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Security Updates for Exchange (October 2021)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-264...

Security Updates for Microsoft System Center Operations Manager (October 2021)

The version of Microsoft System Center Operations Manager installed on the remote Windows host is affected by an information disclosure vulnerability. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to an affected SCOM instance in order to...

Juniper Networks Releases Security Updates for Multiple Products

Juniper Networks has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Juniper Networks security advisories page an...

Vulnerabilities fixed in Foxit products

Vulnerabilities have been fixed in Foxit products. The vulnerabilities allow a malicious person to carry out attacks that lead to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Access to system data Foxit has released updates to fix the vulnerabilitie...

Security Updates for Microsoft Office (October 2021) (macOS)

The Microsoft Office product installed on the remote host is affected by multiple vulnerabilities, as follows: - An information disclosure vulnerability in rich text editing that can be exploited by a low privileged, local user. CVE-2021-40454 - Remote code execution vulnerabilities in Excel that...

RHEL 8 : httpd:2.4 (RHSA-2021:3816)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3816 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: modproxy: SSRF v...

RHEL 7 : kpatch-patch (RHSA-2021:3768)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3768 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...

Patch Tuesday, October 2021 Edition

Microsoft today issued updates to plug more than 70 security holes in its Windows operating systems and other software, including one vulnerability that is already being exploited. This months Patch Tuesday also includes security fixes for the newly released Windows 11 operating system. Separatel...

Digital Signature Spoofing Flaws Uncovered in OpenOffice and LibreOffice

The maintainers of LibreOffice and OpenOffice have shipped security updates to their productivity software to remediate multiple vulnerabilities that could be weaponized by malicious actors to alter documents to make them appear as if they are digitally signed by a trusted source. The list of the...

OracleVM 3.4 : xen (OVMSA-2021-0033)

The remote OracleVM system is missing necessary patches to address security updates: - IOMMU page mapping issues on x86 This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Both AMD and Intel allow ACPI tables to specify...

Security Updates for Microsoft Sharepoint Server 2016 (October 2021)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2021-40484...

Security Updates for Microsoft SharePoint Server 2013 (October 2021)

The Microsoft SharePoint Server 2013 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Security Updates for Microsoft Office Products (October 2021)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. CVE-2021-40454, CVE-2021-40472 - A remote code execution...