Vulnerability fixed in Mitel MiContact Center

Mitel has fixed a vulnerability in MiContact Center. The vulnerability allows an authenticated malicious party with access to the Enterprise License Manager portal is able to obtain system data obtain. Mitel has released updates to fix the vulnerability. More information can be found on the page...

Vulnerability found in Keycloak

A vulnerability has been found in Keycloak. The vulnerability allows a malicious person to use the new-account console to execute to execute arbitrary code. Red Hat reports that the vulnerability in version 13 of Keycloak has been fixed. At Keycloak itself, this information cannot be found found...

Vulnerabilities fixed in FreeBSD

Several vulnerabilities have been fixed in FreeBSD. The vulnerabilities allow a malicious person, potentially unauthenticated remote, be able to carry out attacks resulting in the following categories of damage: Bypassing authentication Bypassing security measure Accessing sensitive data Access t...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed multiple vulnerabilities in Visual Studio and Visual Studio Code. The vulnerabilities allow a malicious person able to execute arbitrary code under the privileges of the user. The vulnerability with reference CVE-2021-21300 has been classified by Microsoft rated "Critical" the...

Vulnerability fixed in Trend Micro products

Trend Micro has fixed a vulnerability in products that use the Virus Scan API VSAPI and/or the Advanced Threat Scan Engine ATSE. The vulnerability allows an unauthenticated remote malicious party capable of causing a denial-of-service cause. Trend Micro has released updates for numerous products ...

Vulnerabilities fixed in Android

Several vulnerabilities have been fixed in Android. The vulnerabilities allow a malicious person, remote or otherwise, to perform able to launch attacks that result in the following categories of damage: Remote code execution Administrator/Root rights Remote code execution User rights Access to...

Vulnerability fixed in Kaspersky Endpoint Security

Kaspersky has fixed a vulnerability in Kaspersky Endpoint Security and Kaspersky Rescue Disk. A local malicious person with administrator privileges or a malicious person with physical access to the vulnerable device could exploit the vulnerability to bypass of UEFI Secure Boot. This could allow...

Vulnerabilities fixed in ClearPass Policy Manager

Vulnerabilities have been fixed in ClearPass Policy Manager. The vulnerabilities allow a malicious party to conduct attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Remote code execution Administrator/Root rights SQL Injection Increased user...

Vulnerabilities fixed in IBM Spectrum Protect Plus

Vulnerabilities have been fixed in IBM Spectrum Protect. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Remote code execution Administrator/Root rights Circumvention of security measure IBM...

Vulnerabilities fixed in Red Hat OpenShift Container Platform

Red Hat has fixed multiple vulnerabilities in OpenShift Container Platform. The vulnerabilities allow an unauthenticated remote malicious party potentially able to launch attacks leading to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Access to...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in Office products. A malicious party could exploit the vulnerabilities to cause a denial-of-service, obtain sensitive data, impersonate another user, and/or execute arbitrary code with user privileges. Below is a summary of the various vulnerabilities describe...

Vulnerabilities fixed in MISP

Vulnerabilities have been fixed in MISP. The vulnerabilities allow a malicious person to bypass a security measure and perform a Cross-Site Scripting XSS attack. Such an attack can result in the execution of arbitrary script code in the browser used to visit the application. The developers of MIS...

Vulnerabilities fixed in Aruba Airwave Glass

Vulnerabilities have been fixed in Aruba Airwave Glass. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Remote code execution Administrator/Root privileges...

Actively exploited vulnerability fixed in SolarWinds Orion

SolarWinds has fixed a vulnerability in the Orion Platform. A malicious party could exploit this vulnerability to bypass authentication within the Orion API. Subsequently, the API can be used to compromise the Orion installation or underlying operating system. The vulnerability is actively...

Vulnerabilities fixed in Arista EOS

Arista has fixed several vulnerabilities in EOS. The vulnerabilities marked CVE-2020-15897, CVE-2020-15898, CVE-2020-24360 and CVE-2020-26569 allow a malicious person to cause cause a denial-of-service DoS. To do this, rogue network traffic to the device. The vulnerability with reference...

Vulnerabilities fixed in Citrix Secure Mail

Citrix has fixed vulnerabilities in Citrix Secure Mail. A malicious party can use a rogue app to gain access to the email data and, to a lesser extent, the calendar data stored in the victim's Citrix Secure Mail. The vulnerability is located in Citrix Secure Mail for Android. Citrix Secure Mail f...

Vulnerabilities fixed in QNAP QTS

Vulnerabilities have been fixed in QNAP-QTS. The vulnerabilities allow a malicious person to perform Cross-Site Scripting XSS attacks. QNAP has released updates to fix the vulnerabilities. More information can be found on the pages below: https://www.qnap.com/en/security-advisories...

Vulnerability fixed in Kibana

A vulnerability has been fixed in Kibana. The vulnerability allows a malicious party the opportunity to spoof a URL and to cause a Denial-of-Service. Elastic has released bug fixes to address the vulnerability. fix. More information can be found on the pages below: Bug 1898572:...

Multiple vulnerabilities fixed in Intel systems

Intel has fixed several vulnerabilities in Converged Security and Manageability Engine CSME, Server Platform Services SPS, Trusted Execution Engine TXE, Dynamic Application Loader DAL, Active Management Technology AMT and Standard Manageability ISM. Malicious parties can exploit the vulnerabiliti...

Vulnerability fixed in Adobe Dreamweaver

Adobe has fixed a vulnerability in Dreamweaver. The vulnerability allows a malicious party to obtain elevated rights to obtain. Adobe has released updates to fix the vulnerability. More information can be found on the page below: https://helpx.adobe.com/security/products/dreamweaver/apsb20-55.htm...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed several vulnerabilities. A malicious remote user could potentially exploit the vulnerabilities to execute arbitrary execute arbitrary code, bypass security measures or access gain access to sensitive data. Information about the vulnerability with reference CVE-2020-16937 is...

Vulnerabilities fixed in Microsoft Windows

Microsoft fixes multiple vulnerabilities in Windows. A malicious party could potentially exploit the vulnerabilities to execute arbitrary code, to obtain elevated privileges, gain access to sensitive data, launch a denial-of-service attack, or to bypass a security measure. The vulnerability with...

Vulnerabilities fixed in SUSE

Several vulnerabilities have been fixed in SUSE Linux Enterprise. The vulnerabilities potentially enable a local malicious person to execute attacks that result in the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Accessing sensitive data Access to syste...

Vulnerabilities fixed in Android

Several vulnerabilities have been fixed in Google Android. The vulnerabilities allow a malicious person remote or otherwise potentially able to carry out attacks leading to the following categories of damage: Remote code execution User rights. Access to sensitive data Access to system data...

Vulnerabilities fixed in SAP products

Vulnerabilities have been fixed in SAP products. An authentication check was missing in SAP Solution Manager. The vulnerabilities in SAP BusinessObjects Business Intelligence Platform were not explained further. SAP has released updates to fix the vulnerabilities. More information can be found on...

Vulnerabilities fixed in Oracle kernel

Vulnerabilities have been fixed in Oracle kernel. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS. Access to sensitive data Access to system data -= Oracle =- Oracle has made updates available for Oracle Linux ...

Fixed vulnerability in Citrix Workspace (formerly Citrix Receiver)

A vulnerability has been fixed in the automatic update service of the Citrix Workspace app for Windows that could result in increased user privileges. Citrix has made an update available to fix the vulnerability. fix. For more information, see the following page:...

Vulnerability fixed in Pulse Secure Client for Windows

A vulnerability has been fixed in Pulse Secure Client for Windows. The vulnerability allows a locally authenticated malicious party the ability to obtain elevated SYSTEM privileges. obtain. Security researcher Red Timmy Security has published a write-up regarding the vulnerability published at:...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in Cisco products. The vulnerabilities are all in the Cisco Discovery Protocol CDP. The vulnerabilities allow an unauthenticated malicious person using a rogue CDP packet to establish a Denial-of-Service and potentially execute arbitrary code execution. Because CDP...

Vulnerabilities fixed in Linux kernel (SACK PANIC)

Netflix has identified a number of vulnerabilities in the Linux kernel. A malicious party could potentially exploit them to cause a denial-of-service. The vulnerabilities relate to the "minimum segment size" MMS and TCP Selective Acknowledgement SACK capabilities. The most serious of these...

Vulnerabilities found in Oracle Communications

Oracle has identified 31 vulnerabilities in various Oracle Communications products, including Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module – ASR, Oracle Communications Service Catalo...

Vulnerability handling is handled differently in GitLab Community and Enterprise editions.

GitLab has identified a vulnerability in both the Community and Enterprise editions of the platform. The vulnerability resides in the repository commit API, where path traversal is possible. As a result, unauthenticated users can read arbitrary files on the system. The root cause of the...

vulnerabilities in Adobe Illustrator

Adobe has identified several vulnerabilities in Adobe Illustrator. These vulnerabilities lie in the way Adobe Illustrator processes files. One vulnerability involves incorrect authorization, which allows an attacker to execute arbitrary code when a user opens a malicious file. Another vulnerabili...

vulnerabilities present in Microsoft Office

Microsoft has patched 114 vulnerabilities in various Office products. A malicious individual could exploit these vulnerabilities to carry out attacks that can lead to various types of damage, as listed in the table below. For successful exploitation, the attacker would need to trick the victim in...

vulnerabilities in Adobe Campaign Classic

Adobe has identified vulnerabilities in Adobe Campaign Classic. These vulnerabilities allow attackers to execute arbitrary code without user interaction. One of the vulnerabilities involves incorrect authorization, allowing attackers to perform actions beyond the intended permissions. Another...

Vulnerabilities in Arista VeloCloud Orchestrator On-Prem

Arista has identified vulnerabilities in VeloCloud Orchestrator On-Prem. These vulnerabilities exist in the on-premises deployment of VeloCloud Orchestrator. There is an unauthorized endpoint that allows for the rotation of certificate authorities. Additionally, there is a Bash command injection...

Vulnerabilities Fixed in SolarWinds Serv-U

SolarWinds has addressed several vulnerabilities in Serv-U. The vulnerabilities in SolarWinds Serv-U primarily involve insecure direct object reference IDOR and broken access control. These vulnerabilities allow attackers with certain privileges—such as domain administrator or group administrator...

Vulnerability fixed in BIND 9

ICS has fixed a vulnerability in BIND 9. The vulnerability is located in certain versions of BIND 9, where malformed BRID/HHIT records can lead to the unexpected termination of the named service, which is critical for DNS resolution. This vulnerability allows attackers to crash the service throug...

Vulnerabilities fixed in Ivanti Endpoint Manager

Ivanti has fixed vulnerabilities in Ivanti Endpoint Manager Specific for versions prior to 2024 SU4 SR1. The vulnerabilities are located in several components of Ivanti Endpoint Manager. The first vulnerability involves a stored XSS vulnerability that allows unauthenticated attackers to execute...

Vulnerabilities fixed in Microsoft Exchange

Microsoft has fixed vulnerabilities in Exchange. An authenticated malicious party can exploit the vulnerabilities to impersonate another user or grant themselves elevated privileges, potentially gaining access to sensitive data that the malicious party is not initially authorized to access...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server. An authenticated malicious party can exploit the vulnerability to use specially prepared SQL statements SQL Injection to grant themselves elevated privileges and thus gain access to sensitive information that the malicious party is not initially...

Vulnerability fixed in Progress MOVEit Transfer

Progress has fixed a vulnerability in MOVEit Transfer Specifically for versions 2025.0.0 to 2025.0.3, 2024.1.0 to 2024.1.7, and 2023.1.0 to 2023.1.16. The vulnerability involves uncontrolled resource consumption that can lead to resource depletion, which can affect the performance and availabilit...

Vulnerabilities fixed in VMware NSX

VMware fixed vulnerabilities in VMware NSX The vulnerabilities in VMware NSX include a weak password recovery mechanism that allows unauthenticated attackers to enumerate valid usernames, which can result in potential brute-force attacks on login credentials. Additionally, there is a username...

Vulnerabilities fixed in Cisco IOS XR Software

Cisco has fixed vulnerabilities in Cisco IOS XR Software. The vulnerabilities are in how Cisco IOS XR Software handles management interface ACL processing, the installation process and ARP implementation. A malicious party can exploit these vulnerabilities to bypass configured access control list...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows, including Hyper-V, Graphics Component, and Routing and Remote Access Service RRAS. The vulnerabilities include several types of attacks, such as local privilege escalation, unwarranted access to sensitive information, and the potential for...

Vulnerability fixed in WinRAR

Rarlab has fixed a vulnerability in WinRAR. The vulnerability is in the Windows version of WinRAR and involves a path traversal. This flaw allows attackers to execute arbitrary code using malicious archive files. This can lead to unauthorized access and control of affected systems. Public sources...

Vulnerabilities fixed in Salesforce Tableau Server

Salesforce has fixed vulnerabilities in Salesforce Tableau Server Specifically for versions lower than 25.1.3, 2024.2.12, and 2023.3.19. The vulnerabilities include unauthorized access to data via user-controlled keys, authorization bypass, unrestricted file uploads of dangerous file types,...

Vulnerabilities fixed in Cisco ISE and ISE-PIC

Cisco has fixed vulnerabilities in Cisco ISE and ISE-PIC. The vulnerabilities are in the way Cisco ISE and ISE-PIC process files through APIs and validate user input. Unauthenticated attackers with access to the API interface can exploit these vulnerabilities to upload and execute arbitrary files...

Vulnerability fixed in Keycloak

Red Hat has fixed a vulnerability in Keycloak. The vulnerability is in the way Keycloak handles privileged users. A privileged user can gain full administrative control over a realm, which can lead to unauthorized changes to user roles and configurations. This is especially risky in environments...

Vulnerabilities fixed in Zoom Clients

Zoom has fixed vulnerabilities in Zoom Clients Specifically versions for Linux, Windows, iOS and macOS. The vulnerabilities include incorrect certificate validation in Zoom Workplace for Linux, a buffer overflow in specific Zoom Clients for Windows, cross-site scripting in Zoom Clients for Window...