Vulnerabilities fixed in GitLab Community Edition and Enterprise Edition

Vulnerabilities have been fixed in GitLab. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Bypassing authentication Circumvention of security measure Remote code execution User rights...

Vulnerability found in Mitel MiVoice Connect

A vulnerability has been found in the Service Appliance component of MiVoice Connect. This vulnerability allows a remote malicious remote user to execute arbitrary code with the permissions with which the Service Appliance component is running. Mitel has made mitigating measures available to fix...

Vulnerabilities fixed in Oracle E-Business Suite

Oracle has fixed vulnerabilities in E-Business Suite applications. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Manipulation of data. Remote code execution User rights Access to sensitive data Access to system data The...

Vulnerabilities fixed in Oracle Systems

Oracle has fixed vulnerabilities in the following products: Oracle Solaris Cluster Oracle ZFS Storage Appliance Kit Oracle StorageTek ACSLS Oracle StorageTek Tape Analytics STA Oracle Solaris Oracle Ethernet Switch ES1-24 Oracle Ethernet Switch TOR-72 The vulnerabilities allow a malicious party t...

Vulnerabilities fixed in Microsoft Azure Site Recovery

Vulnerabilities have been fixed in Microsoft Azure Site Recovery. The vulnerabilities allow a malicious party to obtain elevated rights or to execute arbitrary code. With the exception of CVE-2022-24469, an attacker already needs need elevated privileges to one or more of the components that are...

Vulnerabilities fixed in Oracle Supply Chain

Oracle has fixed vulnerabilities in the following products: Demantra Demand Management Agile Engineering Data Management Agile PLM MCAD Connector Agile PLM Framework Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite Rapid Planning Product Lifecycle Analytics The...

Vulnerabilities fixed in GitLab Runner

Vulnerabilities have been fixed in GitLab Runner. A authenticated malicious party could potentially exploit them to cause a denial-of-service or to gain access to system data. GitLab developers have released updates to address the vulnerabilities in GitLab Runner 14.3.4, 14.4.2 and 14.5.2. For mo...

Vulnerability fixed in Microsoft Malware Protection Engine

Microsoft has fixed a vulnerability in the Microsoft Malware Protection Engine as used by Windows Defender and Microsoft System Center Endpoint Protection. The vulnerabilities allow a malicious person to execute arbitrary code. The following table lists the vulnerabilities...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in the following products: SAP ABAP Platform Kernel SAP Commerce SAP ERP Financial Accounting SAP ERP HCM Portugal SAP Focused SAP GUI for Windows SAP NetWeaver Application Server for ABAP and ABAP Platform. SAP Solution Manager The vulnerabilities potentially enable...

Vulnerabilities fixed in Cisco Webex

Vulnerabilities have been fixed in Cisco Webex. The vulnerabilities marked CVE-2021-1500 and CVE-2021-40128 allow an unauthenticated remote malicious person able to trick a user to trick a user into opening a rogue Web page. The vulnerability with reference CVE-2021-40115 allows a malicious perso...

Vulnerabilities fixed in Oracle Peoplesoft products

Oracle has fixed vulnerabilities in the following PeopleSoft products: PeopleSoft Enterprise PT PeopleTools PeopleSoft Enterprise CS SA Integration Pack PeopleSoft Enterprise SCM Purchasing PeopleSoft Enterprise CS Academic Advisement PeopleSoft Enterprise CS Student Records. PeopleSoft Enterpris...

Vulnerability fixed in NetApp Clustered Data ONTAP

NetApp has fixed a vulnerability in the BSD sub-layer of Clustered Data ONTAP. The vulnerability is located in the ipv6 impelementation and potentially allows a malicious party to cause a denial-of-service exploit. NetApp has released updates to fix the vulnerability in Clustered Data ONTAP. For...

Vulnerabilities fixed in Adobe products

Vulnerabilities have been fixed in several Adobe products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Access to syste...

Vulnerabilities fixed in Xerox FreeFlow Print Server

Xerox has fixed vulnerabilities in Freeflow Print Server. This patch update includes, among other things, a fix for the PrintNightmare vulnerability located in the Windows Print Spooler service and affects the Windows Print Queue. Xerox has released updates to fix vulnerabilities in Freeflow prin...

Vulnerabilities fixed in Adobe Media Encoder

Adobe has fixed vulnerabilities in Media Encoder. A malicious party could exploit the vulnerabilities to gain access to system data, or execute arbitrary code with permissions of the application. To do this, the malicious party must entice the victim to open a rogue file. Adobe has released updat...

Vulnerabilities fixed in IBM Cognos

IBM has fixed vulnerabilities in Cognos Analytics. The vulnerabilities allow an unauthenticated malicious person, possibly remotely, be able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Access to sensitive data Access...

Vulnerabilities fixed in Android

Several vulnerabilities have been fixed in Android. The vulnerabilities allow a malicious person, remote or otherwise, to perform able to launch attacks that result in the following categories of damage: Remote code execution Administrator/Root rights Remote code execution User rights Access to...

Vulnerability fixed in Citrix ShareFile

A vulnerability has been fixed in the storage zones controller of Citrix ShareFile. The vulnerability allows an unauthenticated remote malicious party to obtain a sensitive data obtain. It is good practice to place these storage zone controllers in the in-house network with DMZ tooling to protect...

Vulnerability fixed in Red Hat kernel

Vulnerabilities have been fixed in the Red Hat kernel. The vulnerabilities allow a locally authenticated malicious agent to able to cause a denial-of-service and to launch a so-called chache-poisioning attack. -= Red Hat =- Red Hat has made updates available for Red Hat Enterprise Linux 8. You ca...

Vulnerabilities fixed in Apple macOS

Apple has fixed a large number of vulnerabilities in Apple MacOS Big Sur 11, Catalina 10.15 and Mojave 10.14. A malicious person can exploit the vulnerabilities to cause the following types of damage cause: Denial-of-Service DoS. Remote code execution User rights Access to sensitive data -= Apple...

Vulnerability fixed in Atlassian Bamboo

A vulnerability has been fixed in Atlassian Bamboo. A unauthenticated malicious person could exploit the vulnerability to obtain system data. Atlassian has released updates to fix the vulnerability in Bamboo. For more information, see: https://confluence.atlassian.com/bamboo...

Vulnerability fixed in Oracle Siebel

Oracle has fixed several vulnerabilities in Siebel. The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service Manipulation of data...

Vulnerabilities fixed in Oracle JD Edwards

Oracle has fixed vulnerabilities in the following Oracle JD Edwards products: JD Edwards EnterpriseOne Tools JD Edwards EnterpriseOne Orchestrator The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to launch attacks execute attac...

Multiple vulnerabilities fixed in F5 BIG-IP products

Multiple vulnerabilities have been identified in F5 BIG-IP, an external malicious person could exploit them to create a denial of service condition, spoofing, execution of external code, data manipulation, cross-site scripting and trigger security restrictions on the targeted system. F5 has...

Vulnerabilities fixed in F5 BIG-IP

Vulnerabilities have been fixed in F5 BIG-IP. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Circumvention of security measure Spoofing Accessing sensitive data F5 has released updates...

Vulnerabilities fixed in Juniper Networks Junos OS

Juniper Networks has fixed vulnerabilities in Junos OS. The vulnerabilities allow an unauthenticated remote malicious person to remotely able to cause a denial-of-service. Juniper Networks categorizes these vulnerabilities according to the CVSSv3 method with a highest score of 7.5. Juniper Networ...

Vulnerability fixed in Sonicwall

Due to a vulnerability in SonicOS, a remote malicious party can cause a Denial of Service DoS and potentially execute arbitrary code execute arbitrary code by sending a malicious request to the firewall. SonicWall has released updates to address the vulnerability. fix. For more information, see:...

Vulnerability fixed in Samba

Ubuntu has fixed a vulnerability in Samba. The vulnerability potentially allows a malicious party to obtain domain administrator rights. The vulnerability with reference CVE-2020-1472 in Samba in that case should be exploited in conjunction with a vulnerable Microsoft domain controller to be...

Vulnerabilities fixed in Red Hat JBoss Enterprise Application Platform

Vulnerabilities have been fixed in Red Hat JBoss Enterprise Application Platform. The vulnerabilities allow a malicious person to able to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Bypassing authenticatio...

Multiple vulnerabilities fixed in Oracle Java SE

Oracle has fixed several vulnerabilities in Oracle Java SE. A malicious party could potentially exploit the vulnerabilities to gain elevated privileges, to access potentially sensitive data or to launch a denial-of-service attack. An overview of the fixed vulnerabilities:...

Vulnerability exposure in Cisco Secure Email Gateway

Cisco has identified a vulnerability in Cisco Secure Email Gateway. This vulnerability lies in the processing of email messages within the Cisco AsyncOS software for Cisco Secure Email Gateway. It arises due to insufficient validation of incoming email messages. An unauthorized malicious actor ca...

Several vulnerabilities exist in IBM AIX and IBM PowerVM VIOS.

IBM has hidden vulnerabilities in AIX and PowerVM VIOS. Additionally, IBM has also hidden previous vulnerabilities in products such as DB2, WebSphere, Oracle products like Java and GraalVM, PostgreSQL, OpenSSH, and Perl, for products produced for use with AIX. A malicious individual could exploit...

Vulnerabilities in Mattermost

Mattermost, Inc. has identified vulnerabilities in Mattermost versions 10.11.x, 11.7.x, and 11.8.x, including the GitLab plugin up to version 11.8. These vulnerabilities relate to various aspects of the Mattermost software, such as incorrect validation of WebSocket command fields, incorrect...

Vulnerability handling in Cisco Secure Firewall ASA and FTD software

Cisco has identified a vulnerability in Cisco Secure Firewall ASA and FTD software. The vulnerability resides in the heap inspection mechanism within the Remote Access SSL VPN service. It arises due to insufficient error checking during the processing of HTTP requests. An unauthenticated external...

Vulnerabilities in Adobe ColdFusion

Adobe has addressed several vulnerabilities in Adobe ColdFusion versions 2025.0.11, 2023.0.22, and earlier versions. These vulnerabilities could be exploited by unauthorized malicious actors to execute arbitrary code remotely, circumvent security measures, escalate system privileges, or disrupt t...

How to hide vulnerability in macOS screen sharing with Apple

Apple has identified a vulnerability in the Screen Sharing feature of macOS versions Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. This vulnerability relates to an authentication issue in the Screen Sharing function, which allows network attackers to gain access without valid login credentials...

Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities primarily involve incorrect authorization, which allows attackers with varying privilege levels to circumvent security checks. This enables attackers to obtain unauthorized read and write permissions, access...

Lack of transparency in the Microsoft Power BI server

Microsoft has identified a vulnerability in the Power BI server. A malicious individual could exploit this vulnerability to execute arbitrary code on the server. For successful exploitation, the malicious individual must have access to prior authentication. Microsoft has provided updates that...

vulnerabilities handled in Microsoft Developer Tools

Microsoft has identified vulnerabilities in various Developer Tools. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage, as listed in the table below. For successful exploitation, the malicious individual must deceive victims into importing and...

Vulnerabilities found in Oracle Communications

Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...

Vulnerabilities in Oracle E-Business Suite components

Oracle has identified several vulnerabilities in the Oracle E-Business Suite, including various modules such as Work in Process, Application Object Library, HRMS, Applications Framework, Advanced Collections, Advanced Outbound Telephony, Advanced Pricing, Applications DBA, Bills of Material,...

Flaws hidden in Microsoft Dynamics

Microsoft has identified a vulnerability in Dynamics NAV and 365 Business Central. A malicious individual could exploit this vulnerability to execute arbitrary code on the vulnerable system through a malicious login request. Since Dynamics often has publicly accessible interfaces and does not...

vulnerabilities hidden in Microsoft Defender

Microsoft has addressed vulnerabilities in Defender. A malicious individual could exploit these vulnerabilities to gain enhanced privileges, execute arbitrary code with system rights, and/or access sensitive data. The malicious individual would need to deceive the victim into downloading and...

Vulnerabilities are being addressed in the Progress MOVEit Automation system.

Progress has addressed vulnerabilities in MOVEit Automation. The vulnerability with identifier CVE-2026-4670 involves a bypass of authentication in MOVEit Automation. A malicious individual without rights can exploit this vulnerability without any user interaction being required. The second...

Vulnerabilities fixed in Apple iOS and iPadOS

Apple fixed vulnerabilities in iOS 15 & 16 and iPadOS 15 & 16 The vulnerabilities are in the way memory is managed in various Apple products. An attacker could exploit these vulnerabilities by processing malicious Web content, which could lead to memory damage and possibly execute arbitrary code...

Vulnerabilities fixed in Veeam Backup & Replication

Veeam has fixed vulnerabilities in Veeam Backup & Replication. The vulnerabilities allow an authenticated domain user to remotely execute code on the backup server, which can lead to unauthorized control of backup operations. This issue is present in the backup server environment and can be...

Vulnerabilities fixed in GitLab

GitLab fixed vulnerabilities in versions 18.9.2, 18.8.6 and 18.7.6 The vulnerabilities included several issues, including incorrect authorization checks that allowed authenticated users to access sensitive data, such as metadata from private repositories, and enabling denial-of-service situations...

Vulnerabilities fixed in Cisco Secure Firewall systems

Cisco has fixed several vulnerabilities in Cisco Secure Firewall including ASA and FTD software. The vulnerabilities include SQL injection, privilege escalation, denial-of-service, cross-site scripting, and improper management of entries in various Cisco Secure Firewall components. Authenticated...

Vulnerability fixed in Google Chrome

Google has fixed a vulnerability in Google Chrome for versions prior to 145.0.7632.75. The vulnerability is in the way Google Chrome handles CSS and involves a use-after-free issue. This can lead to remote code execution via specially crafted HTML pages. Both Google Chrome and Microsoft Edge base...

Vulnerability fixed in PEAR

PEAR has fixed a vulnerability in version 1.33.0. The vulnerability is in how the pregreplace function handles the /e modifier. This poses a risk of unauthorized code execution, which could compromise the integrity of applications using this framework. The patch fixes this problem by ensuring tha...