Vulnerabilities fixed in Zimbra Collaboration

Zimbra has fixed vulnerabilities in Zimbra Collaboration formerly Zimbra Collaboration Suite. The vulnerabilities allow a malicious party to obtain elevated user privileges, or to launch a Cross-Site Scripting XSS attack. A such attack can lead to execution of arbitrary code in too context of the...

Vulnerabilities fixed in IBM MQ

IBM has fixed vulnerabilities in MQ. A malicious party could exploit the exploit the vulnerabilities to cause a denial-of-service gain access to sensitive data, or to launch a Cross-Site-Scripting XSS attack. Such an attack can lead to execution of arbitrary code in the browser of the victim, or...

Vulnerability fixed in Rockwell Automation FactoryTalk

Rockwell Automation has fixed a vulnerability in FactoryTalk Service Platform. A malicious party could exploit the vulnerability to obtain the Service Token to gain unauthorized access gain unauthorized access to other FactoryTalk systems connected to the infrastructure. Once gained access, the...

Vulnerabilities fixed in Oracle Siebel CRM

Oracle has fixed vulnerabilities in Siebel CRM. A unauthenticated malicious person could exploit the vulnerabilities to cause a denial-of-service. Oracle has made updates available to fix the vulnerabilities. fix. For more information, see: https://www.oracle.com/security-alerts/cpujan2024.html...

Vulnerabilities fixed in Rockwell Automation FactoryTalk Activation Manager

Rockwell Automation has fixed vulnerabilities in the FactoryTalk Activation Manager. A malicious party could exploit them to cause a denial-of-service, or potentially execute arbitrary code on the vulnerable system and thereby take over the system and thus access and manipulate the system data an...

Vulnerabilities fixed in IBM DB2

IBM has fixed vulnerabilities in DB2. A malicious party could exploit the exploit the vulnerabilities to grant himself elevated privileges, or to cause a denial-of-service by executing a specially prepared query. These updates also include several updates to third-party products to include older...

Vulnerability fixed in Solarwinds Platform

Solarwinds has fixed a vulnerability in Solarwinds Platform. A malicious party could exploit the vulnerability to use SQL-Injection to gain access to sensitive data, or potentially execute arbitrary code with application privileges. For successful exploitation, the malicious party must be...

Vulnerability fixed in Adobe Animate

Adobe has fixed a vulnerability in Animate. A local malicious party could exploit the vulnerability to gain access to sensitive data. The malicious party does not need any prior authorizations required. Adobe has released updates to fix the vulnerability in Animate 24.0 and 23.0.3. For more...

Vulnerabilities fixed in Oracle Enterprise Manager

Vulnerabilities have been fixed in Oracle Enterprise Manager products. A malicious party can exploit the vulnerabilities to perform attacks that can result in the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Accessing sensitive data Oracle has fixed the...

Vulnerability fixed in Oracle JD Edwards

A vulnerability has been fixed in Oracle JD Edwards products. A malicious party could exploit the vulnerability to gain access gain access to sensitive data. ------------------.------.------------------------------------- | CVE ID | CVSS | Vector |...

Vulnerabilities fixed in Microsoft Exchange Server

Microsoft has fixed a vulnerability in Exchange Server. A malicious party could potentially exploit the vulnerability to execute arbitrary code under SYSTEM privileges. For successful exploitation, the malicious party must be authenticated and authorized on the local network. As far as is known,...

Vulnerabilities fixed in ISC BIND

ISC has fixed vulnerabilities in BIND. A malicious party can exploit the exploit the vulnerabilities to cause a denial-of-service. The vulnerability with reference CVE-2023-3341 is located in the way in which control channel messages are processed. If too large messages, the named process can...

Vulnerabilities fixed in Zimbra

Zimbra has fixed vulnerabilities in Zimbra Collaboration. A malicious party can exploit the vulnerabilities to launch a Cross-Site Scripting XSS attack. Such an attack can lead to execution of arbitrary code in the browser of the victim, or access sensitive data in the context of the victim's...

Vulnerability fixed in Fortinet FortiWeb

Fortinet has fixed a vulnerability in FortiWeb. A malicious party can exploit the vulnerability to implement security measures against Cross-Site-Scripting XSS and Cross-Site-Request-Forgery XSRF and thus carry out these types of such attacks on web applications which should be protected against...

Vulnerabilities fixed in Adobe Connect

Adobe has fixed vulnerabilities in Connect. A malicious person could exploit the vulnerabilities to launch a Cross-Site Scripting attack attack. Such an attack could lead to execution of arbitrary code in the victim's browser, or access to sensitive data in the context of the victim's browser. Fo...

Vulnerability fixed in Zimbra

Zimbra has fixed a vulnerability in Zimbra Collaboration. An unauthenticated malicious person could exploit the vulnerability to gain access to a user account and thus potentially gain access to sensitive data in the context of that account. To the best of our knowledge, no user interaction is...

Vulnerabilities fixed in Adobe Acrobat and Acrobat Reader

Adobe has fixed vulnerabilities in Acrobat and Acrobat Reader. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Circumvention of security measure. Remote code execution User rights Acces...

Vulnerability fixed in Apache Jackrabbit

Apache Foundation has fixed a vulnerability in Jackrabbit. A malicious party could exploit the vulnerability to execute arbitrary execute code with permissions from the application using of Jackrabbit. Because Jackrabbit is executed with the privileges of the application, it cannot be ruled out...

Vulnerabilities fixed in Oracle VirtualBox

Oracle has fixed vulnerabilities in VirtualBox. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or execute arbitrary code with application privileges. ------------------.------.------------------------------------- | CVE ID | CVSS | Vector |...

Vulnerability fixed in Oracle Solaris

Oracle has fixed a vulnerability in Solaris. A local malicious person could exploit the vulnerability to execute arbitrary code execute arbitrary code as root. Oracle has made updates available to fix the vulnerabilities. fix. For more information, see:...

Vulnerabilities fixed in Oracle Java SE

Vulnerabilities have been fixed in Oracle Java SE products. A malicious party could exploit the vulnerabilities to gain access to sensitive data. The malicious party must trick the victim into executing untrusted Java code. Oracle has fixed the vulnerabilities in the following products: - Oracle...

Vulnerabilities fixed in Oracle Enterprise Manager

Vulnerabilities have been fixed in Oracle Enterprise Manager products. A malicious party can exploit the vulnerabilities to execute attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights Access to...

Vulnerabilities fixed in Apple macOS, iOS, iPadOS and Safari

Apple has fixed vulnerabilities in macOS, iOS, iPadOS and Safari. An unauthenticated malicious person could exploit them to execute arbitrary code on the vulnerable system. The most serious vulnerability has been assigned attribute CVE-2023-32434 assigned and allows a malicious person to execute...

Vulnerability fixed in Adobe Animate

Adobe has fixed a vulnerability in Animate. A malicious party could exploit the vulnerability to execute arbitrary code with user privileges. The malicious person needs to trick the victim into opening a rogue file to do so. open. Adobe has released updates to fix the vulnerability in Animate...

Vulnerabilities fixed in GeoServer

GeoServer has fixed vulnerabilities in the OGC filters of GeoServer and GeoTools. A malicious party can exploit exploit the vulnerabilities to improperly access publicly access publicly accessible data or execute arbitrary SQL code on the underlying database. execute arbitrary SQL code on the...

Vulnerability fixed in Dradis Pro

Dradis has fixed a vulnerability in Dradis Pro. A malicious party could exploit the vulnerability to perform a cross-site scripting attack. Such an attack can lead to execution of arbitrary code in the context of the browser of the victim, or access sensitive data within that same context of the...

Vulnerabilities fixed in Autodesk AutoCad

Autodesk has fixed vulnerabilities in AutoCad. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or possibly execute code with user privileges. This requires the malicious party to trick the victim into opening a rogue XB file to open. Autodesk has released updates...

Vulnerabilities fixed in Cisco Prime Infrastructure and Evolved Programmable Network Manager (EPNM)

Cisco has fixed vulnerabilities in the web management interface of Prime Infrastructure and Evolved Programmable Network Manager EPNM. A malicious person with access to the management interface can exploit the exploit vulnerabilities to obtain system information, or to execute commands in the...

Vulnerability fixed in HP LaserJet printers

HP has fixed a vulnerability in the firmware of several LaserJet systems. An unauthenticated malicious person could exploit the exploit the vulnerability to gain access to sensitive data when IPSEC is enabled. HP has released updates to fix the vulnerability in the vulnerable LaserJet systems. Fo...

Vulnerabilities fixed in Apache OpenOffice

Apache has fixed vulnerabilities in OpenOffice. A malicious party can exploit the vulnerabilities to execute arbitrary code execute arbitrary code in the context of the application, with permissions from the victim. To do this, the malicious party must trick the victim into opening a malicious fi...

Vulnerability fixed in IBM Aspera Faspex

IBM has fixed a vulnerability in Aspera Faspex. A authenticated malicious user can use the vulnerability to change the password of another user. IBM has released a new container image to fix the vulnerability fix in Aspera Faspex 5.0.4. For more information, see:...

Vulnerability fixed in FortiOS

FortiNet has fixed a vulnerability in FortiOS. The vulnerability is located in the management environment and allows an unauthenticated malicious person, with access to that management interface, be able to perform a denial-of-service on the management interface, or execute arbitrary code on the...

Vulnerabilities fixed in Node.js

Vulnerabilities have been fixed in node.js. A malicious party can exploit the vulnerabilities to bypass security measures and thus gain access to modules and code for which which it is not authorized. Also, the malicious party can cause a Denial-of-Service, or through host header injection...

Vulnerability fixed in VMware vRealize Operations

A vulnerability has been fixed in VMware vRealize Operations. A malicious person with user privileges within the same network is able to able to bypass Cross-Site Request Forgery CSRF protection. As a result, a malicious party may be able to launch a CSRF attack cross-site request forgery attack ...

Vulnerabilities fixed in Snipe-IT

Several vulnerabilities have been fixed in Snipe-IT. The vulnerabilities allow a remote malicious person to launch an XSS attack and to retrieve usernames. To exploit the XSS vulnerability, the malicious party must be authenticated and have rights to Accessory and Consumables to modify. The...

Vulnerabilities fixed in Aruba AirWave Management Platform

Aruba has fixed vulnerabilities in the AirWave Management Platform. The vulnerabilities allow an authenticated user, without administrator privileges, may be able to perform to perform administrative tasks within the application. Aruba indicates that at least viewing and modifying network...

Vulnerability fixed in Atlassian Crowd

A vulnerability has been fixed in Atlassian Crowd. This vulnerability allows a malicious person to, through a configuration error to authenticate itself and thereby interact with the user management REST API. In doing so, the IP of the attacker must be on the allow list, which is not the default...

Vulnerabilities fixed in IBM Db2

IBM has released updates to fix vulnerabilities in DB2. With the exception of CVE-2022-22390, the vulnerabilities are located in the log4j component of the application. For more information about the log4j vulnerabilities, see: https://www.ncsc.nl/actueel/advisory?id=NCSC-2021-1052 The...

Vulnerabilities fixed in FoxIT PDF Reader and Editor

FoxIT has fixed vulnerabilities in PDF Reader and PDF Editor. A malicious party could exploit the vulnerabilities to cause a denial-of-service, gain access to sensitive data or to execute code in the victim's scope. The malicious party must trick the victim into opening a rogue file to open. FoxI...

Vulnerabilities fixed in Cisco Identity Serrvices Engine (ISE).

Cisco has fixed several vulnerabilities in the Identity Services Engine ISE. A malicious person with access to the management interface can exploit the vulnerabilities for attacks that can lead to the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS...

Vulnerability fixed in FortiManager and FortiAnalyzer

FortiNet has fixed a vulnerability in FortiManager and FortiAnalyzer. A malicious person with low privileges can exploit the exploit the vulnerability to perform a cross-site scripting attack via the reporting module. Such an attack can lead to the execution of arbitrary code in the context of th...

Vulnerability fixed in Zoom

A vulnerability has been fixed in Zoom. The vulnerability allows a malicious person to bypass a security measure and gain access to sensitive data. To exploit the vulnerability, a malicious person needs to victim to open a rogue link. This enables the malicious party to perform further attacks su...

Vulnerability fixed in Cisco Jabber

Cisco has fixed a vulnerability in the Jabber clients for Windows, macOS, iOS and Android. A malicious party could potentially exploit the vulnerability to use nested XMPP messages to manipulate the behavior of the vulnerable client and thus potentially gain access to sensitive data or, as Cisco...

Vulnerability fixed in Redis

A vulnerability has been fixed in Redis. The vulnerability allows a malicious party to use heap overflow to execute arbitrary code with user privileges or a denial-of-service DoS. To exploit the vulnerability, a malicious party must issue an XAUTOCLAIM command with a rogue COUNT argument on a key...

Vulnerabilities fixed in iOS and iPadOS

Apple has fixed vulnerabilities in iOS and iPadOS. The vulnerabilities allow a malicious party to carry out attacks execute attacks that lead to the following categories of damage: Remote code execution Kernel/Root permissions Access to sensitive data Access to system data Increased user privileg...

Vulnerabilities fixed in apache OpenOffice

Apache Software Foundation has fixed vulnerabilities in OpenOffice. The vulnerabilities allow a malicious person with access to the system to retrieve user passwords stored in a user's configuration database. The vulnerabilities involve weak encryption on this configuration database. Apache has...

Vulnerabilities fixed in Microsoft Developer Tools

Vulnerabilities have been fixed in Microsoft Visual Studio and .NET Core, part of Developer Tools. The vulnerabilities allow a malicious party to gain access to sensitive data and to execute arbitrary code under the privileges of the user. For the vulnerability with attribute CVE-2022-34716 in .N...

Vulnerabilities fixed in Microsoft Edge

Vulnerabilities have been fixed in Microsoft Edge. A remote malicious person could potentially exploit the vulnerabilities to execute arbitrary code, bypass security measures and/or obtain elevated user privileges. The vulnerabilities marked CVE-2022-33636 and CVE-2022-33649 potentially enable a...

Zero-day vulnerability discovered in Microsoft Word

A researcher has found a zero-day vulnerability in Microsoft Word. This new exploit in Office macros, external template files containing malicious code while macros are disabled. When a user converts the document to RTF format, the code is also executed in "Protected view" or "Preview mode. For...

Vulnerabilities fixed in IBM MQ

IBM has fixed multiple vulnerabilities in supporting software supplied with IBM MQ. The vulnerabilities are in gzip, jackson-databind, libssh, gnutls, nettle and zlib and have been previously fixed in the individual products. A malicious party could potentially exploit the vulnerabilities to gain...