Serious vulnerabilities fixed in SolarWinds Orion

Vulnerabilities have been fixed in SolarWinds Orion. The vulnerability with reference CVE-2021-25274 allows an unauthenticated remote malicious person to execute arbitrary code with SYSTEM privileges. The vulnerability with attribute CVE-2021-25275 allows a local malicious person to access...

Vulnerabilities fixed in Apache ActiveMQ

Vulnerabilities have been fixed in Apache ActiveMQ. The vulnerabilities allow a malicious party to bypass authentication bypassing. Bypassing authentication is only possible when the optional LDAP login module is used. Apache has released updates to fix the vulnerability. More information can be...

Vulnerabilities fixed in Xerox WorkCentre

Xerox has fixed a number of vulnerabilities in Xerox WorkCentre multifunction printers. Passwords, which are stored on the multifunctional are better encrypted, system accounts have been made visible and manageable, and the ability to use the included McAfee Embedded Control has been removed. One...

Vulnerabilities fixed in Oracle Enterprise Manager

Oracle has fixed multiple vulnerabilities in Oracle Enterprise Manager. The vulnerabilities allow an unauthenticated remote malicious party potentially able to launch attacks leading to the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Access to...

Vulnerabilities fixed in Oracle Communications

Vulnerabilities have been fixed in Oracle Communications. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Circumvention of security measure SQL Injection Accessing sensitive data Accessing...

Vulnerabilities fixed in Oracle PeopleSoft

Oracle has fixed several vulnerabilities in PeopleSoft. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS. Data manipulation. Remote code execution User Righ...

Vulnerability fixed in Cisco Security Appliances

Cisco has fixed multiple vulnerabilities in Cisco Email Security Appliance, Cisco Content Security Management Appliance and Cisco Web Security Appliance. A malicious party could exploit it to obtain information about the system. Cisco has released updates to fix the vulnerability. For more...

Vulnerabilities fixed in SolarWinds Network Performance Monitor

Vulnerabilities have been fixed in SolarWinds Network Performance Monitor. The vulnerabilities allow a malicious party to execute attacks that result in the following categories of damage: Remote code execution Administrator/Root privileges. Access to sensitive data Increased user privileges To...

Vulnerabilities fixed in Jenkins

Vulnerabilities have been fixed in Jenkins. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Circumvention of security measure Accessing sensitive data Jenkins has released updates to...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed several vulnerabilities in several developer tools. A malicious party could potentially exploit them to execute arbitrary code with user privileges. Visual Studio: |----------------|------|-------------------------------------| | CVE ID | CVSS | Impact |...

Vulnerability fixed in RSLinx Classic

A denial-of-service vulnerability exists in the Ethernet / IP server functionality of Rockwell Automation RSLinx Classic. A specially crafted network request can result in a denial of service. Rockwell Automation has released updates to address the vulnerabilities fixes in RSLinx Classic. For mor...

Serious vulnerability fixed in Zyxel products

A vulnerability has been fixed in Zyxel products. A researcher found an undocumented user whose both the username and password could be found in plaintext were in firmware. This undocumented account has admin rights. Zyxel has released updates to fix the vulnerability. Zyxel indicated that for AP...

Vulnerabilities fixed in HCL Lotus Notes

HCL has fixed two vulnerabilities in Lotus Notes. A malicious party could exploit the vulnerabilities for a Cross-Site-Scripting XSS attack, potentially running arbitrary execute arbitrary scripts in the victim's browser, or for the perform a denial-of-service DoS on the service. HCL has released...

Vulnerabilities fixed in Arista EOS

Arista has fixed several vulnerabilities in EOS. The vulnerabilities marked CVE-2020-15897, CVE-2020-15898, CVE-2020-24360 and CVE-2020-26569 allow a malicious person to cause cause a denial-of-service DoS. To do this, rogue network traffic to the device. The vulnerability with reference...

Vulnerabilities fixed in LogRhythm SIEM

Vulnerabilities have been fixed in LogRhythm SIEM. The vulnerabilities allow a malicious person to conduct attacks execute attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Circumvention of security measure. Remote code execution Administrator/Root...

Vulnerabilities fixed in openSUSE kernel

Vulnerabilities have been fixed in openSUSE. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Access to system data Increased user privileges -= OpenSUSE =- The developers of...

Vulnerability fixed in Xen

A vulnerability has been fixed in Xen. A malicious person who can execute code in a guest VM under elevated privileges can execute code, could vulnerability could potentially exploit it to cause a denial-of-service on the Xen hypervisor. Potentially, the vulnerability could also be exploited to...

Vulnerability fixed in MISP

CIRCL has fixed a vulnerability in MISP. The vulnerability is located in the handling of templates and allows a malicious party to be able to launch a Cross-Site-Scripting attack XSS attack, potentially executing arbitrary code in the context of the browser. CIRCL has released updates to fix the...

Vulnerabilities fixed in Cisco Security Manager

Cisco has fixed multiple vulnerabilities in Cisco Security Manager. An unauthenticated remote malicious person could potentially exploit the vulnerabilities potentially exploit them to execute arbitrary code execute under SYSTEM privileges or to gain access to certain user credentials. For the...

Vulnerabilities fixed in Micro Focus ArcSight Logger

Vulnerabilities have been fixed in Micro Focus ArcSight Logger. The vulnerabilities allow a remote malicious person to execute arbitrary code under the user's privileges. Micro Focus has released updates to address the vulnerabilities. fixes. More information can be found on the page below:...

Vulnerability fixed in Intel processors

A vulnerability has been fixed in some Intel processors. The vulnerability allows a local malicious person to obtain elevated privileges. Intel has released firmware updates to fix the vulnerability. fix. More information can be found on the page below:...

Vulnerabilities fixed in macOS

Apple has released a new version of macOS. This version 11.01 Big Sur fixes a large number of vulnerabilities. A malicious party can exploit the vulnerabilities to access gain access to sensitive data, execute arbitrary code with user privileges or to cause a denial-of-service. The vulnerabilitie...

Vulnerabilities fixed in Cisco AnyConnect Secure Mobility Client

Cisco has fixed vulnerabilities in AnyConnect Secure Mobility Client. The vulnerabilities allow a locally authenticated malicious party to execute arbitrary code under the victim's privileges and to obtain sensitive information obtain. For the vulnerability with attribute CVE-2020-5336, Cisco...

Vulnerabilities fixed in WordPress

WordPress developers have fixed several vulnerabilities fixed. An authenticated remote malicious person could potentially exploit these vulnerabilities potentially exploit them to perform a Cross-Site Scripting XSS attack. Such an attack could lead to the execution of arbitrary script code in the...

Multiple vulnerabilities fixed in F5 BIG-IP products

F5 has fixed several vulnerabilities in BIG-IP. Malicious remotely can exploit the vulnerabilities to cause a Denial-of-Service or perform Cross-Site-Scripting attacks. Authenticated malicious actors can exploit some of the vulnerabilities exploit them to bypass security measures and gain access...

Serious vulnerability fixed in Oracle Weblogic Server

Oracle has released an update for Weblogic Server to fix a serious vulnerability. This new vulnerability is related to the Fusion Middleware vulnerability with attribute CVE-2020-14882, for which an update was released in October. This was described by the NCSC in security advisory NCSC-2020-0858...

Vulnerabilities fixed in Check Point Zone Alarm Extreme Security

Check Point fixed vulnerabilities in Zone Alarm Extreme Security. The vulnerabilities allow a local malicious party to able to delete files restored from an archive and to obtain elevated privileges. Check Point has released a new version to address the vulnerabilities fixes. More information can...

Vulnerability fixed in FortiOS

A vulnerability has been fixed in FortiOS. The vulnerability allows an authenticated attacker to obtain sensitive data, for example, passwords stored in cleartext. Fortinet has released updates to fix the vulnerability. More information can be found on the page below:...

Vulnerability fixed in Red Hat OpenShift

Red Hat has fixed a vulnerability in OpenShift. The vulnerability allows a malicious owner of a pod to possible to bypass a security measure in the restricted Context Constraints Object to bypass. This enables the malicious person to enabled to send custom network packets. Red Hat scales this...

Vulnerabilities fixed in Trend Micro Antivirus for Mac

Trend Micro has fixed vulnerabilities in Antivirus for Mac. The vulnerabilities allow a locally authenticated malicious agent to able to cause a denial-of-service or to obtain system data obtain. Trend Micro categorizes these vulnerabilities according to the CVSSv3 method with a highest score of...

Vulnerabilities fixed in Oracle Hyperion

Oracle has fixed vulnerabilities in the following Oracle Hyperion products: Hyperion Analytic Provider Services Hyperion BI+ Hyperion Essbase Hyperion Infrastructure Technology Hyperion Planning Hyperion Lifecycle Management The vulnerabilities allow an unauthenticated malicious person with netwo...

Vulnerability in Ghisler Total Commander

There is a vulnerability in Ghisler Total Commander. The vulnerability allows a local malicious person to obtain elevated permissions by replacing the Total Commander binary. The developers of Total Commander have indicated that they will not fix the vulnerability will not be fixed. According to...

Vulnerability fixed in Snort

A vulnerability has been fixed in Snort. The vulnerability allows an unauthenticated remote malicious person to enable an security measure to bypass. Cisco has released updates to fix the vulnerability. More information can be found on the page below: https://tools.cisco.com/security/center/conte...

Vulnerability fixed in Adobe InDesign

Adobe has fixed a vulnerability in InDesign. The vulnerability allows a malicious party to execute arbitrary code execute arbitrary code under user privileges. Adobe has released updates to fix the vulnerability. More information can be found on the page below:...

Vulnerabilities fixed in Adobe Illustrator

Adobe has fixed vulnerabilities in Illustrator. The vulnerabilities allow a malicious party to execute arbitrary code execute arbitrary code under user privileges. Adobe has released updates to fix the vulnerabilities. More information can be found on the page below:...

Vulnerability fixed in Adobe Creative Cloud

Adobe has fixed a vulnerability in Creative Cloud. The vulnerability allows a malicious party to execute arbitrary code execute arbitrary code under user privileges. Adobe has released updates to fix the vulnerability. More information can be found on the page below:...

Vulnerabilities fixed in Siemens Ruggedcom and Scalance

Siemens has fixed multiple vulnerabilities in several Ruggedcom and Scalance products. A remote malicious person could potentially exploit the vulnerabilities to cause a denial-of-service of dnsmasq or execute arbitrary code. To do this requires sending malicious network traffic to the vulnerable...

Vulnerability fixed in Red Hat Satellite

A vulnerability has been fixed in Red Hat Satellite. The vulnerability allows a local malicious person to obtain sensitive data by reading the temporary memory. This vulnerability is exploitable only if an installation of Satellite via RPM an installation of Satellite has taken place. -= Red Hat ...

Vulnerability fixed in Spring Framework

There is a vulnerability in the Spring Framework that enables a Reflected File Download RFD attack. This vulnerability has already been patched NCSC-2015-0888, but researchers have found a way to bypass the mitigation. Pivotal has released new versions of the Spring Framework in which the...

Vulnerabilities fixed in VMware Workstation, Fusion and Horizon

Vulnerabilities have been fixed in VMware Workstation, Fusion and Horizon. The vulnerability with reference CVE-2020-3980 relates to VMware Fusion and allows a malicious party to obtain elevated user privileges. The remaining CVE characteristics enable a malicious person to cause a...

Vulnerability fixed in Red Hat JBoss Enterprise Application Platform

A vulnerability has been fixed in JBoss Enterprise Application Platform. The vulnerability allows a malicious party to launch a Denial-of-Service DoS attack. -= Red Hat =- Red Hat has made updates available. You can install these updates install using the command 'yum'. More information about the...

Vulnerabilities fixed in McAfee Agent

Vulnerabilities have been fixed in McAfee Agent. The vulnerabilities allow a malicious party to launch attacks that result in the following categories of damage: Remote code execution Administrator/Root rights Remote code execution User rights Increased user privileges McAfee has released updates...

Vulnerabilities fixed in Sophos UTM Up2Date

Sophos has fixed multiple vulnerabilities in Up2Date for Sophos UTM. The vulnerabilities allow a remote malicious person potentially able to cause a denial-of-service or gain access gain access to sensitive information. Sophos has released updates to fix the vulnerabilities in Sophos UTM Up2Data...

Vulnerabilities fixed in Kaspersky Security Center

Kaspersky has fixed multiple vulnerabilities in Kaspersky Security Center. The vulnerabilities allow a local malicious able to cause a denial-of-service or obtain elevated privileges obtain elevated privileges on the local system. Not all of the vulnerabilities have assigned a CVE number. Kaspers...

Vulnerabilities fixed in Ubuntu Linux kernel

Canonical has fixed several vulnerabilities in the Ubuntu Linux kernel. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the following categories of damage: Denial-of-Service Manipulation of data Access to sensitive data Increased user privileges...

Vulnerabilities fixed in Google Chrome

Google has fixed several vulnerabilities in Chrome. Little little substantive information made publicly available. Of a number of vulnerabilities, no CVE IDs have been disclosed yet. A malicious party could potentially exploit the vulnerabilities to bypass security measures and possibly cause a...

Vulnerabilities fixed in Cisco Data Center Network Manager

Cisco has fixed several vulnerabilities in the Data Center Network Manager. The vulnerabilities allow a local authenticated malicious party to conduct attacks that can lead to the following types of damage: Cross-Site Scripting XSS. Manipulation of data Access to system data Increased user...

Vulnerability fixed in Fedora kernel

A vulnerability has been fixed in the Fedora kernel. The vulnerability allows a local malicious person to access gain access to system data. Fedora has made updates available for Fedora 32. You can install these updates by using the 'dnf' or 'yum' command. More information about these updates and...

Vulnerability fixed in TeamViewer

A vulnerability has been fixed in TeamViewer. The vulnerability allows an unauthenticated remote malicious party to opportunity to cause TeamViewer to send out an NTLM request. The malicious party to do this must induce the victim to visit a rogue website. The NTLM request can be captured by the...

Vulnerabilities fixed in Microsoft Office products

Microsoft fixes multiple vulnerabilities in Microsoft Office and Microsoft SharePoint products. A remote malicious person could vulnerabilities potentially exploit them to execute arbitrary code execute arbitrary code, obtain elevated privileges, access sensitive data, or to perform...