Vulnerability fixed in IBM Filenet Content Manager

IBM has fixed a vulnerability in Filenet Content Manager and Content Navigator. An authenticated malicious party could exploit the exploit the vulnerability for a cross-site scripting XSS attack and thus potentially obtain the login credentials of other users find out. IBM has released updates to...

Vulnerability fixed in HPE Systems Insight Manager

A vulnerability has been fixed in HPE Systems Insight Manager. A malicious party could potentially exploit the vulnerability to execute arbitrary code under elevated privileges. The vulnerability is located in optional features called "Federated Search" and "Federated CMS Configuration." The...

Vulnerabilities fixed in ArubaOS

Hewlett Packard has fixed vulnerabilities in ArubaOS. The vulnerability with reference CVE-2020-24637 was known earlier this year become known as "Boothole" NCSC-2020-0614. This vulnerability allows a malicious person with sufficient access to the system to load a rogue kernel. The remaining...

Vulnerabilities fixed in SAP products

Vulnerabilities have been fixed in several SAP products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Bypassing authentication. Remote code execution Administrator/Root rights Spoofing Access to system data...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed multiple vulnerabilities in several developer tools. A malicious party could potentially exploit them to execute arbitrary code with user privileges. Vulnerabilities related to Visual Studio can only be be exploited by convincing the user to open rogue files. Visual Studio:...

Vulnerabilities fixed in Atlassian Crucible

Atlassian has fixed vulnerabilities in Crucible. The vulnerabilities allow a remote malicious person to perform a denial-of-service. Atlassian has released updates to fix the vulnerabilities. fixes. More information can be found on the pages below: CVE-2020-14190:...

Vulnerabilities fixed in TYPO3

The TYPO3 Association has fixed several vulnerabilities in TYPO3. A remote malicious party could potentially abuse them to perform a Cross-Site Scripting XSS attack. Such an attack can result in the execution of arbitrary script code in the browser used to visit the application visited. The...

Vulnerabilities fixed in Micro Focus ArcSight Logger

Vulnerabilities have been fixed in Micro Focus ArcSight Logger. The vulnerabilities allow a remote malicious person to execute arbitrary code under the user's privileges. Micro Focus has released updates to address the vulnerabilities. fixes. More information can be found on the page below:...

Vulnerability fixed in EcoStruxure Control Expert

A vulnerability has been fixed that could cause a crash of the PLC simulator in EcoStruxure Control Expert software when a specially crafted request is received via Modbus. Schneider Electric has made available a firmware update that fixes the vulnerability. For more information, see:...

Vulnerabilities fixed in Adobe Connect

Adobe has fixed two vulnerabilities in Adobe Connect. A malicious party can use these vulnerabilities to launch a cross-site scripting XSS attack, thus setting up arbitrary javascript code with the victim's privileges. Adobe has released updates to fix the vulnerabilities in Connect 11.0.5. For...

Vulnerabilities fixed in Juniper Networks Junos OS

Vulnerabilities have been fixed in Junos OS. The vulnerabilities allow a malicious party to launch a denial-of-service attack and to execute arbitrary code under the privileges of the user. Juniper has released updates to fix the vulnerabilities. More information can be found on the pages below:...

Vulnerabilities fixed in SonicWall

Vulnerabilities have been fixed in SonicWall Global VPN Client. The vulnerabilities allow a local malicious person to gain elevated rights and to execute arbitrary code under the user's privileges. SonicWall has released updates to address the vulnerabilities. fixes. More information can be found...

Vulnerability fixed in Red Hat OpenShift

Red Hat has fixed a vulnerability in OpenShift. The vulnerability allows a malicious owner of a pod to possible to bypass a security measure in the restricted Context Constraints Object to bypass. This enables the malicious person to enabled to send custom network packets. Red Hat scales this...

Vulnerabilities fixed in Juniper Junos OS

Juniper Networks has fixed several vulnerabilities in Junos OS. A malicious person, whether remotely authenticated or not, could potentially exploit these vulnerabilities to carry out attacks leading to the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS...

Vulnerabilities fixed in Oracle Unbreakable Enterprise Kernel

Oracle has fixed vulnerabilities in the Oracle Unbreakable Enterprise kernel. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitiv...

Vulnerabilities fixed in Samsung Mobile

Samsung has fixed several vulnerabilities in its Android distribution. The vulnerabilities allow a malicious person whether remote or otherwise may be able to launch attacks that lead to the following categories of damage: Denial-of-server DoS. Remote code execution User rights Access to sensitiv...

Vulnerability fixed in Trend Micro Anti-virus

A vulnerability has been fixed in Trend Micro Anti-Virus for Mac. The vulnerability allows a malicious person to obtain elevated privileges. Trend Micro has released updates to fix the vulnerability. fix. More information can be found on the page below:...

Vulnerabilities fixed in Pulse Secure

Vulnerabilities have been fixed in Pulse Secure. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Remote code execution User Rights Access to system data Pulse Secure has released updates to address the...

Vulnerabilities fixed in Ubuntu kernel

Vulnerabilities have been fixed in Ubuntu's kernel. The vulnerabilities allow a malicious person to carry out attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Access to system data Increased user privileges Canonical...

Vulnerability fixed in IBM Aspera Shares

IBM has fixed a vulnerability in Aspera Shares. The vulnerability is known as Cross-Site Scripting. The vulnerability allows a remote malicious person to execute arbitrary code in the victim's browser. To do so, the malicious party must induce the victim to follow a rogue hyper-link to follow. IB...

Vulnerabilities fixed in Jira

Vulnerabilities have been fixed in Jira Server and Data Center. The vulnerabilities allow a malicious party to obtain sensitive data and to launch a denial-of-service attack. execute. Atlassian has released updates to address the vulnerabilities. fixes. More information can be found on the pages...

Vulnerabilities fixed in Android

Vulnerabilities have been fixed in Android 11. The vulnerabilities allow a malicious person to carry out attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS. Bypassing authentication. Remote code execution User Rights Accessing sensitive data Access to...

Vulnerability fixed in FortiOS

Fortinet has fixed a vulnerability in FortiOS. The vulnerability allows a malicious party to perform a Cross-Site Scripting XSS attack. The vulnerability arises from incorrect input validation when generating a Web page in the SSL VPN portal. Fortinet has released updates to fix the vulnerability...

Vulnerability fixed in Citrix Storefront

Citrix has fixed a vulnerability in StoreFront Server. The vulnerability allows an authenticated malicious party to obtain obtain arbitrary data from the StoreFront server. The malicious party must be logged into the same Active-Directory-domain as where the StoreFront logged on to the same...

Vulnerabilities fixed in Siemens Spectrum Power

Siemens has fixed two vulnerabilities in Spectrum Power 4. An unauthenticated malicious person could exploit the vulnerabilities to gain access to system data and sensitive data. Siemens has updates and mitigations available to address the vulnerabilities in Spectrum Power. However, these have no...

Vulnerabilities discovered in HMI Panels

Because SIMATIC HMI panels do not properly handle repeated login attempts correctly, they are susceptible to Brute-force attacks. A malicious party can use them to retrieve user names and passwords find out and thus issue random commands with permissions from the affected user account. To exploit...

Vulnerability discovered in Siemens SIMATIC S&-300 and S7-400 CPUs

Siemens has discovered a vulnerability in the SIMATIC S7-300 and S7-400 CPUs. An unauthenticated malicious person can exploit the exploit the vulnerability to eavesdrop on network traffic and thereby obtaining login credentials. To exploit the vulnerability, the attacker must have access to the...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in Cisco products. These include several Nexus, MDS 9000 switches, UCS and Firepower models. The vulnerabilities enable a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure...

Vulnerabilities fixed in Apache Tomcat

Several vulnerabilities have been fixed in Apache Tomcat. A malicious party could potentially exploit the vulnerabilities to cause a Denial-of-Service on the Tomcat server. To do this the malicious party must send specially crafted HTTP or WebSocket traffic to the vulnerable server. The developer...

Vulnerabilities fixed in GitLab Community and Enterprise Edition

GitLab has fixed a number of vulnerabilities in GitLab Community Edition and Enterprise Edition. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service, execute a cross-site scripting attack, or gain access to sensitive information and/or manipulate it. GitLab has releas...

Vulnerability fixed in Apache Tomcat

A malicious party can exploit the vulnerability to obtain information from the system. The vulnerability was caused because the AJP protocol was incorrectly was implemented incorrectly. A malicious party could possibly read files a malicious request to read files from the webroot directory. The A...

Multiple vulnerabilities fixed in Oracle Java

Oracle has fixed multiple vulnerabilities in Oracle Java. By these vulnerabilities, a malicious person can, if rogue data by a java application are deserialized arbitrary code can execute arbitrary code, gain access to sensitive data or cause a Denial-of-Service cause. Oracle has made updates...

Vulnerability discovered in F5 BIG-IP and BIG-IQ

F5 has discovered a vulnerability in BIG-IP and BIG-IQ products. The vulnerability is located in lodash version 4.17.12, a javascript programming library. A malicious person with access to the Traffic Management User Interface TMUI or the iControl REST API could exploit the vulnerability to execu...

Vulnerabilities in Oracle Commerce Platform

Oracle has identified 27 vulnerabilities in its Commerce Platform, including Oracle Commerce Guided Search and Oracle Commerce Experience Manager, as well as components like Experience Manager, Forge, and Endeca Application Controller. These vulnerabilities concern various security issues in Orac...

Vulnerabilities found in Apple iOS and iPadOS

Apple has identified several vulnerabilities in iOS and iPadOS. These vulnerabilities involve various security issues, such as authentication failures, out-of-bounds write and read errors, use-after-free situations, buffer overflows, race conditions, permission and authorization problems, memory...

Vulnerabilities in Adobe ColdFusion

Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include a stored Cross-Site Scripting XSS vulnerability, where an attacker with low privileges can inject malicious scripts into form fields, which are then executed in the user’s browser. There is also a...

Vulnerabilities in Microsoft Dynamics

Microsoft has patched 2 vulnerabilities in Dynamics, both for online and on-premise environments. These vulnerabilities allow malicious actors to gain elevated privileges, execute arbitrary code, and/or access sensitive data. Microsoft Dynamics 365: | CVE-ID | CVSS | Impact |...

Vulnerabilities in WatchGuard Fireware OS

WatchGuard has identified vulnerabilities in the WatchGuard Fireware OS, specifically in the iked process and the epm-service of the Mobile Security component. These vulnerabilities reside in the iked process and the epm-service of WatchGuard Fireware OS. The iked process contains a stack-based...

Vulnerabilities fixed in Oracle JD Edwards EnterpriseOne Tools

Oracle has fixed vulnerabilities in JD Edwards EnterpriseOne Tools Specifically for versions 9.2.0.0 to 9.2.9.4. The vulnerabilities in JD Edwards EnterpriseOne Tools allow unauthenticated attackers to compromise the system via HTTP, which can lead to unauthorized access and modification of...

Vulnerabilities fixed in Spring Framework

VMWare has fixed vulnerabilities in the Spring Security framework. The vulnerabilities are in the way the Spring Security framework detects annotations, particularly in type hierarchies that use parameterized supertypes with unlimited generics. This can lead to authorization bypassing when using...

Vulnerabilities fixed in Omnissa Workspace ONE UEM

Omnissa has fixed vulnerabilities in Omnissa Workspace ONE UEM. The vulnerabilities are located in the API endpoints of Omnissa Workspace ONE UEM. The first vulnerability allows malicious parties to gain unauthorized access to sensitive information using the Path Traversal technique. This can lea...

Vulnerability fixed in CrushFTP

CrushFTP has fixed a vulnerability in versions 10 through 10.8.5 and 11 through 11.3.423. The vulnerability is located in CrushFTP's AS2 validation. This vulnerability allows an attacker to gain administrative access via HTTPS, especially when the DMZ proxy feature is not used. The vulnerability...

Vulnerabilities fixed in Zoom

Zoom has fixed vulnerabilities in Zoom Clients for Windows. The first vulnerability concerns an untrusted search path issue, which could allow unauthenticated remote users to elevate their privileges via network access. The second vulnerability concerns a race condition in the installer, which ca...

Vulnerabilities fixed in Adobe Illustrator

Adobe has fixed vulnerabilities in Adobe Illustrator Versions 28.7.6, 29.5.1 and earlier. The vulnerabilities are in the way Adobe Illustrator handles rogue files. These vulnerabilities can lead to arbitrary code execution, allowing attackers to perform unauthorized actions on affected systems. T...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities in Splunk Enterprise and Splunk Cloud Platform allow both low-privileged and high-privileged users to perform unauthorized actions, such as suppressing alerts, executing remote commands, and causi...

Vulnerability fixed in Cisco Unified Communications Manager

Cisco has fixed a vulnerability in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. The vulnerability is in the hard-coded root SSH credentials that cannot be changed or deleted. This allows unauthenticated remote attackers to log in and...

Vulnerability fixed in Adobe Illustrator

Adobe has fixed a vulnerability in Illustrator Specifically for versions 29.3, 28.7.5 and earlier. The vulnerability is in the way Illustrator handles files. A malicious party can exploit this vulnerability by creating a malicious file that, when opened by a user, can lead to arbitrary code...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code with the victim's privileges. Successful exploitation requires the malicious party to trick the victim into openi...

Vulnerability fixed in NetApp SnapCenter

NetApp has fixed a vulnerability in SnapCenter Specifically for versions earlier than 6.0.1P1 and 6.1P1. The vulnerability is in the way SnapCenter handles authenticated users. This allows authenticated users to gain administrative access on remote systems equipped with the SnapCenter plug-in. Th...

Vulnerability fixed in Apache Tomcat

Apache has fixed a vulnerability in Apache Tomcat Specifically for versions 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98. The vulnerability is in the way the server handles HTTP PUT requests. By sending a malicious PUT request, an attacker can upload arbitrary files and...