Vulnerabilities fixed in Progress MOVEit Transfer

Progress has fixed vulnerabilities in MOVEit Transfer. The vulnerabilities labeled CVE-2023-40043 and CVE-2023-42660 can be be exploited by an authenticated malicious person to gain access to sensitive data via an SQL injection to gain access to sensitive data. Misuse of the vulnerability with...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in QMS Automotive, Parasolid, WIBU, TeamCenter, JT2GO, SIMATIC, SIPLUS and Ruggedcom products. The vulnerabilities potentially enable a malicious party to launch attacks execute attacks that could result in the following categories of damage: Denial-of-Service Do...

Vulnerability fixed in Cisco Firepower and UCS

Cisco has fixed a vulnerability in Firepower 4100 and 9300 systems and in UCS 6300 systems. The vulnerability is located in SNMP handling and allows a malicious party to cause a denial-of-service exploit. Cisco has released updates to fix the vulnerability in the vulnerable UCS and Firepower...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including Business Objects, Netweaver and Powerdesigner. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Bypassing...

Vulnerabilities fixed in VMware Horizon

VMware has fixed vulnerabilities in Horizon Server. A unauthenticated malicious party could exploit the vulnerabilities to gain access to system data, or through an HTTP-Request Smuggling potentially to gain access to sensitive data. The vulnerabilities are not present in the latest version of...

Vulnerabilities fixed in Zimbra

Vulnerabilities have been fixed in Zimbra. A malicious party could exploit vulnerabilities to gain access to system data, bypass a security measure, or launch a Cross-Site Scripting attack. Such an attack can lead to execution of arbitrary code in the context of the victim's victim's browser, or...

Vulnerabilities fixed in Microsoft Dynamics

Microsoft has fixed vulnerabilities in Dynamics 365 on prem. A malicious party could exploit the vulnerabilities to launch a Cross-site scripting attack. Such an attack can lead to execution of arbitrary code in the context of the victim's browser, or access to sensitive data in the context of th...

Vulnerabilities fixed in Citrix ADC and Gateway

Citrix has fixed vulnerabilities in ADC and Gateway. A malicious party could exploit the vulnerabilities to gain access to system data, or to perform a cross-site scripting attack. Such an attack could result in execution of code in the victim's browser. To access system data, the malicious party...

Vulnerabilities fixed in IBM Qradar

IBM has fixed vulnerabilities in QRadar. An authenticated malicious party can exploit the vulnerabilities to launch attacks execute attacks that could result in the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Remote code execution User Rights Access to system...

Vulnerabilities fixed in HP Laserjet and MultiFunctionals

Hewlett Packard has fixed vulnerabilities in the firmware of various HP Laserjet and MultiFunctional devices. A malicious person could exploit the vulnerabilities to cause a denial-of-service cause, or to execute arbitrary code on the vulnerable device. HP has released updates to fix the...

Vulnerabilities fixed in Fortinet FortiGate

Fortinet has released updates to its FortiGate software. Security researchers indicate that in these updates a serious vulnerability has been fixed in the VPN-SSL. A malicious party could exploit the vulnerability to execute arbitrary code without prior authentication to execute arbitrary code on...

Vulnerability fixed in BitDefender

BitDefender has fixed a vulnerability in Bitdefender Total Security, Bitdefender Internet Security and Bitdefender Antivirus Plus. A malicious person could exploit the vulnerability to grant themselves granted elevated privileges and potentially execute arbitrary code execute arbitrary code with...

Vulnerabilities fixed in cisco Small Business Switch

Cisco has fixed vulnerabilities in a number of series of Small Business Switches. The vulnerabilities are located in the Web interface and enable an unauthenticated malicious person to able to cause a denial-of-service, or to execute arbitrary execute arbitrary code as root. The malicious party...

Vulnerability fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed a vulnerability in GitLab Enterprise Edition EE and Community Edition CE. A malicious person with user privileges could exploit the vulnerability to use a GraphQL endpoint to install rogue runners in any project within the environment and thus execute arbitrary code execute. GitL...

Vulnerabilities fixed in Xwiki

The developers of Xwiki have released updates to fix the vulnerabilities fixed in Xwiki 15.0-rc-1, 14.10.1, 14.4.8 & 13.10.11. For more information, see: https://github.com/xwiki/xwiki-platform/security/advisories /GHSA-jgrg-qvpp-9vwr https://github.com/xwiki/xwiki-platform/security/advisories...

Vulnerabilities fixed in Oracle Database Server

Vulnerabilities have been fixed in Oracle Database Server. The vulnerabilities allow a malicious party to carry out attacks execute attacks that lead to a denial-of-service DoS or manipulation of data. Oracle has fixed vulnerabilities in the following products: - Oracle Database Server - Oracle...

Vulnerability fixed in Adobe Digital Editions

Adobe has fixed a vulnerability in Digital Editions. A malicious party can exploit the vulnerability to execute arbitrary code execute arbitrary code. To do this, the malicious party must trick the victim into opening a malicious file to open. Adobe has released updates to fix the vulnerability i...

Vulnerability fixed in Adobe InCopy

Adobe has fixed a vulnerability in InCopy. A malicious person could exploit the vulnerability to execute arbitrary code with the victim's privileges. To do so, the malicious party must trick the victim into opening a malicious file to open. Adobe has released updates to fix the vulnerability in...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious person could exploit the vulnerabilities to execute arbitrary code with the victim's privileges. The malicious party must trick the victim into opening a malicious file to open. The vulnerability in Sharepoint allows an...

Vulnerabilities fixed in Google Android and Samsung Mobile

Google has fixed vulnerabilities in Android. Also fixed vulnerabilities in closed-source parts of Android that are developed by third parties, such as Qualcomm, Arm, Imagination Technologies, Unisoc and Mediatek. The vulnerabilities potentially enable a malicious person to execute attacks that...

Vulnerabilities fixed in GitLab Enterprise and Community Editions

GitLab has fixed several vulnerabilities in GitLab Enterprise and Community Editions. A malicious person with access to the development environment could exploit the vulnerabilities to launch attacks execute attacks that can result in the following categories of damage: Cross-Site Scripting XSS...

Vulnerabilities fixed in Adobe Dimension

Adobe has fixed vulnerabilities in Dimension. A local malicious person could exploit the vulnerabilities to execute arbitrary code execute with application privileges, or to access gain access to sensitive data in the context of the application. Adobe has released updates to fix the vulnerabiliti...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in Azure Service Fabric and Azure HDInsight Apache Ambari. The vulnerabilities allow a malicious person able to impersonate another user. To do so, the malicious party must entice someone with higher privileges entice someone with higher privileges to click on ...

Vulnerabilities fixed in HP Serviceguard

HP has fixed vulnerabilities in Serviceguard. A malicious person could exploit the vulnerabilities to cause a denial-of-service, or possibly to execute arbitrary code with application privileges. HP has released updates to fix the vulnerabilities in Serviceguard linux A.15.00.00 and A.12.80.05. F...

Vulnerability fixed in Cisco Finesse and Unified Contact Center

Cisco has fixed a vulnerability in Finesse and Unified Contact Center. The vulnerability is in the nginx component. When configured as a reverse proxy, an unauthenticated remote malicious person could exploit it to cause a denial-of-service on the system. Cisco has released updates to fix the...

Vulnerabilities fixed in Citrix products

Several vulnerabilities have been fixed in Citrix products. The vulnerability with reference CVE-2023-24483 is located in Citrix Virtual Apps and Desktops Windows VDAs. An authenticated malicious party could potentially exploit this vulnerability to obtain elevated privileges within a Windows VDA...

Vulnerability remedied in Keycloak

A vulnerability has been fixed in Keycloak. A malicious party can exploit the vulnerability to gain access via path-traversal to sensitive data. The vulnerability is caused by the fact that URL redirects where the client accepts wildcards are not correctly are processed correctly. -= Red Hat =- R...

Vulnerability found in KeePass

A vulnerability has been found in KeePass. A malicious person could potentially exploit the vulnerability to gain access to data stored in a KeePass database. This could include usernames, passwords and email addresses. Successful misuse requires that the malicious party have access to the system...

Vulnerability fixed in Cisco Unified Communications Manager

Cisco has fixed an SQL injection vulnerability in Unified Communications Manager and Unified Communications Manager Session Management Edition SME. An authenticated malicious person with access to the management interface, could exploit the vulnerability to perform SQL injections and thereby gain...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in several components of Windows. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution Administrator/Root rights Remote co...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products. The vulnerabilities potentially enable a malicious person to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Circumvention of security measure. Remote code execution User Rights SQL...

Vulnerability fixed in HP OfficeConnect 1820 and 1850 switches

HPO has fixed a vulnerability in the firmware of its OfficeConnect 1820 and 1850 switches. An unauthenticated malicious party could, by exploiting the vulnerability, perform a directory traversal and thereby gain access to system data. This data could potentially be used to setting up further...

Vulnerabilities fixed in HCL Domino and HCL Notes

Vulnerabilities have been fixed in HCL Domino and HCL Notes. The vulnerabilities allow an unauthenticated remote malicious person to remotely capable of executing arbitrary code. HCL has released updates to fix the vulnerabilities. More information can be found on the pages below: HCL Domino:...

Vulnerability fixed in Citrix Gateway and ADC

Citrix has fixed a vulnerability in Citrix Gateway and Citrix ADC. An unauthenticated remote malicious person could exploit the exploit the vulnerability to execute arbitrary code. To do so, rogue network traffic must be sent to the vulnerable system be sent. Gateway and ADC systems are only...

Vulnerabilities fixed in Zimbra Collaboration

Zimbra has fixed vulnerabilities in Zimbra Collaboration. A malicious party could exploit the vulnerabilities to use a Cross-site scripting attack to gain access to sensitive data, or to execute arbitrary code on the system. To execute arbitrary code, the malicious party needs prior authenticatio...

Vulnerabilities fixed in Liferay Portal

Vulnerabilities have been fixed in Liferay Portal. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Remote code execution User Rights SQL Injection Access to sensitiv...

Vulnerability fixed in IBM MQ

A vulnerability has been fixed in MQ Internet Pass-Thru. The vulnerability allows a local malicious party to potentially see sensitive information in trace files of the application when this feature is enabled. IBM has released updates to fix the vulnerabilities in MQ. For more information, see:...

Vulnerabilities fixed in IBM Db2

IBM has released updates to fix vulnerabilities in DB2. With the exception of CVE-2022-22390, the vulnerabilities are located in the log4j component of the application. For more information about the log4j vulnerabilities, see: https://www.ncsc.nl/actueel/advisory?id=NCSC-2021-1052 The...

Vulnerabilities fixed in Intel Products

Intel has fixed vulnerabilities in the firmware of chipsets from Active Management Technology AMT, Server Platform Services SPS, and PROSet/Wireless WiFi. The vulnerabilities allow a malicious able to perform a denial-of-service DoS or obtain elevated user privileges. Intel has released updates t...

Vulnerabilities fixed in GitLab enterPrise Edition and Community Edition

GitLab has fixed several vulnerabilities in GitLab Enterprise Edition and Community Edition. An authenticated malicious person can exploit the vulnerabilities for attacks that can result in the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Circumvention of...

Vulnerabilities fixed in Oracle Financial Services Applications

Vulnerabilities have been fixed in Oracle Financial Services Applications. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User righ...

Vulnerabilities fixed in Oracle PeopleSoft

Vulnerabilities have been fixed in Oracle PeopleSoft. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Oracle has fixed vulnerabilities in the following products:...

Vulnerability fixed in Apache Commons Text

A vulnerability has been fixed in Apache Commons Text. The vulnerability allows an unauthenticated remote malicious person potentially able to execute arbitrary code with the privileges of the vulnerable application. To do so, a malicious person must have specific text processed by the vulnerable...

Vulnerabilities fixed in Bentley View and MicroStation

Vulnerabilities have been fixed in Bentley View and MicroStation. The vulnerabilities allow a malicious party to access system data and to execute arbitrary code under the user's privileges. To do this, the malicious party must trick the victim into running open a rogue SKP, XMT, or FBX file. It ...

Vulnerabilities fixed in Dell BIOS

Vulnerabilities have been fixed in the BIOS of Dell products. The vulnerabilities allow a malicious person to execute arbitrary execute arbitrary code under administrator privileges and manipulate data manipulate data. To exploit the vulnerabilities, an authenticated malicious party must have...

Vulnerabilities fixed in SAP products

SAP has released updates to fix the vulnerabilities. For more information, see: https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10...

Vulnerabilities fixed in Aruba ArubaOS and InstantOS

Aruba Networks has fixed vulnerabilities in ArubaOS and InstantOS, which are used in various access points from Aruba Networks. A malicious party can exploit the vulnerabilities to cause a denial-of-service, or to execute arbitrary code execute arbitrary code on the vulnerable system. To cause a...

Vulnerabilities fixed in Aruba ClearPass Policy Manager

Aruba has fixed vulnerabilities in ClearPass Policy Manager CPPM. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Denial-of-Service DoS. Remote code execution Administrator/Roo...

Vulnerabilities fixed in Nessus Agent

Tenable has fixed two vulnerabilities in Nessus Agent. A authenticated malicious person with the ability and knowledge to create custom audit files could exploit the vulnerabilities to execute code with administrator privileges, or to access gain access to arbitrary system files of the underlying...

Vulnerabilities fixed in Microsoft Edge

Vulnerabilities have been fixed in Microsoft Edge. A remote malicious person could potentially exploit the vulnerabilities to execute arbitrary code, bypass security measures and/or obtain elevated user privileges. The vulnerabilities marked CVE-2022-33636 and CVE-2022-33649 potentially enable a...