Non-Privilege user can view Patient's Amendments

Description We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 latest version Open-Source electronic health records and medical practice management application has Insecure direct object reference IDOR to function “Patient’s Amendments”, and it never bee...

[SECURITY] Fedora 35 Update: golang-github-jacobsa-oglemock-0-0.8.20190622gite94d794.fc35~bootstrap

Oglemock is a mocking framework for the Go programming language with the following features: - An extensive and extensible set of matchers for expressing call expectatio ns provided by the oglematchers package. - Clean, readable output that tells you exactly what you need to know. - Style and...

Vulnerabilities fixed in Oracle Enterprise Manager

Oracle has fixed vulnerabilities in the following Enterprise Manager products: Enterprise Manager Base Platform Enterprise Manager Ops Center Oracle Application Testing Suite Enterprise Manager for MySQL Database The vulnerabilities potentially enable a malicious party to execute attacks that...

This Week in Spring - July 19th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week Im trying to wind down some threads and take some vacation with my family. Its going to be an amazing time, indeed! But that doesnt stop the deluge of novelties and news in the wide world of Springdom, so weve got a...

How to ‘Win’ a Red Team Exercise

What is a red team exercise? Organizations that conduct red team exercises use penetration testing tactics to assess vulnerabilities and discover weak points in their cybersecurity preparation. Usually, this involves two teams - one red the protagonists and one blue the incident responders who mu...

Fedora: Security Advisory for golang-github-pact-foundation (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-shopify-toxiproxy-2.1.4-10.fc35

Toxiproxy is a framework for simulating network conditions. It's made specifically to work in testing, CI and development environments, supporting deterministic tampering with connections, but with support for randomized chaos and customization. Toxiproxy is the tool you need to prove with tests...

[SECURITY] Fedora 35 Update: golang-github-pact-foundation-1.5.1-6.fc35

Pact Go enables consumer driven contract testing, providing a mock service and DSL for the consumer project, and interaction playback and verification for t he service provider project...

[SECURITY] Fedora 35 Update: golang-github-onsi-ginkgo-2-2.1.4-2.fc35

A Modern Testing Framework for Go...

[SECURITY] Fedora 35 Update: golang-github-nicksnyder-i18n-2-2.1.2-5.fc35

go-i18n is a Go package and a command that helps you translate Go programs in to multiple languages. - Supports pluralized strings for all 200+ languages in the Unicode Common Locale Data Repository CLDR. - Code and tests are automatically generated from CLDR data. - Supports strings with named...

[SECURITY] Fedora 35 Update: golang-github-gucumber-0-0.23.20190703git7d5c79e.fc35

An implementation of Cucumber BDD-style testing for Go...

[SECURITY] Fedora 35 Update: golang-github-google-martian-3.1.0-9.fc35

Martian Proxy is a programmable HTTP proxy designed to be used for testing. Martian is a great tool to use if you want to: - Verify that all or some subset of requests are secure - Mock external services at the network layer - Inject headers, modify cookies or perform other mutations of HTTP...

[SECURITY] Fedora 35 Update: golang-github-facebookincubator-contest-0-0.4.20210706gitceebc35.fc35

Run continuous and on-demand system testing for real and virtual hardware...

[SECURITY] Fedora 35 Update: golang-github-burntsushi-toml-test-0.2.0-11.20210108git9767d20.fc35

Toml-test is a higher-order program that tests other TOML decoders or encoder s. The goal is to make it comprehensive. Tests are divided into two groups: inva lid TOML data and valid TOML data. Decoders that reject invalid TOML data pass invalid TOML tests. Decoders that accept valid TOML data an...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

GHSA-8MJR-JR5H-Q2XR OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

Impact This vulnerability affects all accounts vanilla and ethereum flavors in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's...

Microsoft Security Update Validation Report July 2022

Microsoft’s July 2022 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English-only environments and issues may still be found upon implementation. Follow best practices for testing and installing software...

Mendix Structure Disclosure

The vulnerability of the Mendix software deployment and application testing platform is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to disclose the structure of the created project...

Mendix Database Disclosure

The vulnerability of the software platform for deploying and testing Mendix application programs is related to configuration errors. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Microsoft Windows Autopatch is Now Generally Available for Enterprise Systems

Microsoft on Monday announced the general availability of a feature called Autopatch that automatically keeps Windows and Office software up-to-date on enrolled endpoints. The launch, which comes a day before Microsoft is expected to release its monthly round of security patches, is available for...