Veeam Availability Orchestrator stops collecting vCenter asset information

Challenge There is an issue with the embedded Veeam ONE component of Veeam Availability Orchestrator 1.0 release. The issue results in Veeam ONE not recognizing new VMware vCenter assets approximately 90 days after installation. Cause There is a synchronization issue between Veeam ONE Monitor and...

The vulnerability of the IOFireWireAVC component of the Mac OS X operating system allows a hacker to execute arbitrary code with kernel privileges.

The vulnerability of the IOFireWireAVC component in the Mac OS X operating system is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability allows an attacker to execute arbitrary code with kernel privileges through a specially created...

Yosoro Cross-Site Scripting Vulnerability

Yosoro is a desktop application for synchronizing the contents of your hard drive in the cloud. A cross-site scripting vulnerability exists in Yosoro version 1.0.4. A remote attacker can exploit this vulnerability to execute arbitrary code...

Kernel security update: Virtuozzo ReadyKernel patch 54.0 for Virtuozzo 7.0.7 HF2 and 7.0.7 HF3

The cumulative Virtuozzo ReadyKernel patch was updated with security and stability fixes. The patch applies to Virtuozzo 7.0 kernels 3.10.0-693.21.1.vz7.46.7 7.0.7 HF2 and 3.10.0-693.21.1.vz7.48.2 7.0.7 HF3. Vulnerability id: CVE-2018-1120 By mmaping a FUSE-backed file onto a process's memory...

[SECURITY] Fedora 27 Update: git-annex-6.20180626-1.fc27

Git-annex allows managing files with git, without checking the file contents into git. While that may seem paradoxical, it is useful when dealing with f iles larger than git can currently easily handle, whether due to limitations in memory, time, or disk space. It can store large files in many...

Design/Logic Flaw

A vulnerability has been identified in SICLOCK TC100 All versions and SICLOCK TC400 All versions. An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of th...

CVE-2018-4851

A vulnerability has been identified in SICLOCK TC100 All versions and SICLOCK TC400 All versions. An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of th...

CVE-2018-4851

A vulnerability has been identified in SICLOCK TC100 All versions and SICLOCK TC400 All versions. An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of th...

CVE-2018-4851

The CVE-2018-4851 issue affects Siemens SICLOCK TC100 and TC400 (all versions). An attacker with network access can trigger a Denial-of-Service by sending specific packets, potentially rebooting the device and impacting core functionality. Time-serving resumes after time synchronization with GPS ...

CVE-2018-8025: Concurrent Execution using Shared Resource with Improper Synchronization

CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an...

CVE-2018-5236: Concurrent Execution using Shared Resource with Improper Synchronization

Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition or race hazard. This type of issue occurs in software where the output is dependent on the sequence or timing of other uncontrollable events...

Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM SONAS (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296)

Summary A fix is available for IBM SONAS, for the security vulnerabilities in Network Time Protocol NTP being used. Vulnerability Details Network Time Protocol NTP is used in IBM SONAS for synchronizing time. CVEID: CVE-2014-9293 DESCRIPTION: Network Time Protocol NTP Project NTP daemon ntpd coul...

Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296)

Summary A fix is available for IBM Storwize V7000 Unified, for the security vulnerabilities in Network Time Protocol NTP being used. Vulnerability Details Network Time Protocol NTP is used in IBM Storwize V7000 Unified for synchronizing time. CVEID: CVE-2014-9293 DESCRIPTION: Network Time Protoco...

Security Bulletin: IBM Security Access Manager for Mobile is affected by multiple NTP vulnerabilities

Summary The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. IBM Security Access Manager for Mobile uses NTP and is affected by multiple NTP vulnerabilities. Vulnerability Details CVEID: CVE-2014-9297 DESCRIPTION: Network Time Protocol NTP...

Security Bulletin: privilege escalation in IBM Business Process Manager (BPM) - CVE-2017-1539

Summary Synchronization between the user registry and the IBM BPM database lead to invalid memberships in case there is an internal group in the IBM BPM database and a group in the user registry with the same name. Vulnerability Details CVEID: CVE-2017-1539 DESCRIPTION: IBM Business Process Manag...

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

CVE-2017-5427: Concurrent Execution using Shared Resource with Improper Synchronization

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in...

CVE-2016-9077: Concurrent Execution using Shared Resource with Improper Synchronization

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox 50...

Important: kernel

Issue Overview: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged code...

CVE-2018-1120

A flaw was found affecting the Linux kernel before version 4.17. By mmaping a FUSE-backed file onto a process's memory containing command line arguments or environment strings, an attacker can cause utilities from psutils or procps such as ps, w or any other program which makes a read call to the...