Vulnerabilities fixed in Liferay Portal and DXP

Liferay has fixed vulnerabilities in Portal and DXP. A malicious party could exploit the vulnerabilities to perform of cross-site scripting XSS attacks. Such attacks can lead to execution of script code in the context of the victim's browser, or access sensitive data in the context of the browser...

Vulnerability fixed in Atlassian Confluence

Atlassian has fixed a vulnerability in Confluence. A malicious party could exploit the vulnerability to break into publicly accessible Confluence Data Center and Server instances, create unauthorized Confluence administrator accounts and gain access to Confluence instances. Atlassian has released...

ZeroDay vulnerabilities fixed in Apple iOS and iPadOS

Apple has fixed vulnerabilities in iOS and iPadOS. A malicious party can exploit the vulnerabilities to circumvent a security measure in order to bypass it, grant themselves elevated privileges granted and execute arbitrary code on the vulnerable system Apple has reports that the vulnerabilities...

Vulnerabilities fixed in ISC BIND

ISC has fixed vulnerabilities in BIND. A malicious party can exploit the exploit the vulnerabilities to cause a denial-of-service. The vulnerability with reference CVE-2023-3341 is located in the way in which control channel messages are processed. If too large messages, the named process can...

Vulnerability fixed in Trend Micro Apex One

Trend Micro has fixed a vulnerability in Apex One. A local, authenticated malicious party can exploit the vulnerability exploit to execute arbitrary code with permissions from the system. For successful abuse, the malicious party must have prior sufficient privileges on the admin console of the...

Vulnerability fixed in Elastic Kibana

Elastic has fixed a vulnerability in Kibana. A authenticated malicious person could exploit the vulnerability to obtain obtain sensitive data from the log, such as user credentials and system credentials. Elastic has released updates to fix the vulnerability in Kibana 8.10.1. Version 8.10.0 has...

Vulnerabilities fixed in Adobe Connect

Adobe has fixed vulnerabilities in Connect. A malicious person could exploit the vulnerabilities to launch a Cross-Site Scripting attack attack. Such an attack could lead to execution of arbitrary code in the victim's browser, or access to sensitive data in the context of the victim's browser. Fo...

Vulnerabilities fixed in Zimbra

Zimbra has fixed vulnerabilities in Zimbra Collaboration. A malicious party can exploit the vulnerabilities to launch a Cross-Site Scripting XSS attack. Such an attack can lead to execution of arbitrary code in the browser of the victim, or access sensitive data in the context of the victim's...

Vulnerabilities fixed in Rarlab WinRAR

Rarlab has fixed vulnerabilities in WinRAR. A malicious person could exploit the vulnerabilities to execute arbitrary execute arbitrary code with user privileges. The vulnerability with reference CVE-2023-40477 is located in the way How WinRAR handles Recovery Volumes. A malicious party can creat...

Vulnerabilities fixed in Microsoft Dynamics

Microsoft has fixed vulnerabilities in Dynamics. A malicious party could exploit the vulnerabilities to afford elevated privileges, or execute arbitrary code with user privileges. Successful exploitation requires the malicious party to trick the victim into following a rogue link or opening a rog...

Vulnerability fixed in Mirth Connect

A vulnerability has been fixed in Mirth Connect. A unauthenticated malicious person could exploit the vulnerability to execute arbitrary code with application privileges. Because Mirth Connect without additional configuration by default installed with elevated privileges by default, it cannot be...

Vulnerabilities fixed in Oracle Financial Services Applications

Vulnerabilities have been fixed in Oracle Financial Services Applications products. A malicious party could exploit them to launch attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution...

Vulnerability fixed in Oracle Solaris

Oracle has fixed a vulnerability in Solaris. A local malicious person could exploit the vulnerability to execute arbitrary code execute arbitrary code as root. Oracle has made updates available to fix the vulnerabilities. fix. For more information, see:...

Vulnerabilities fixed in Oracle Java SE

Vulnerabilities have been fixed in Oracle Java SE products. A malicious party could exploit the vulnerabilities to gain access to sensitive data. The malicious party must trick the victim into executing untrusted Java code. Oracle has fixed the vulnerabilities in the following products: - Oracle...

Vulnerabilities fixed in Oracle VirtualBox

Oracle has fixed vulnerabilities in VirtualBox. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or execute arbitrary code with application privileges. ------------------.------.------------------------------------- | CVE ID | CVSS | Vector |...

Vulnerabilities fixed in Atlassian Confluence

Atlassian has fixed vulnerabilities in Confluence. A malicious party could exploit the vulnerabilities to execute arbitrary code execute arbitrary code with application privileges and possibly thereby gain access to sensitive data. The malicious party needs prior authentication required. Atlassia...

Vulnerability fixed in Apple macOS, iOS, iPadOS and Safari

Apple has released interim updates for macOS, iOS, iPadOS and Safari to fix a vulnerability in WebKit. A malicious party can exploit the vulnerability to execute arbitrary code execute arbitrary code with user privileges. The malicious party must to do so, trick the victim into opening a rogue fi...

Vulnerability discovered in Cisco ACI Multi-Site CloudSec Encryption

Cisco has discovered in internal testing that the encryption as used with ACI Multi-Site CloudSec is not sufficient to provide adequate protection in the event of a man-in-the-middle attack. A malicious party capable of tapping the encrypted traffic between two ACI sites, and has sufficient...

Vulnerability fixed in TOPdesk

TOPdesk has fixed a vulnerability in TOPdesk Self-service and TOPdesk Operator. A malicious party with a valid account can exploit the exploit the vulnerability to impersonate any other user and thus gain access to and manipulate their data. manipulate. The vulnerability lies in the way SAML Sing...

Vulnerability discovered in MOVEit Transfer

Progress has indicated in a blog post that a vulnerability has been found in MOVEit Transfer. The vulnerability allows an unauthenticated remote malicious person to obtain sensitive data through of an SQL injection to obtain sensitive data. The vulnerability has not yet been assigned a CVE...

Vulnerabilities fixed in Microfocus ArcSight Logger

Micro Focus has fixed vulnerabilities in ArcSight Logger. A malicious party could exploit the vulnerabilities to launch a Cross-site Scripting attack, or an XML External Entity Injection. Such an attack can lead to execution of arbitrary code in the context of the victim's browser, or access data...

Vulnerability fixed in Citrix Sharefile and Content Collaboration

Citrix has fixed a vulnerability in the StorageZones Controller as in use with Sharefile and Content Collaboration. A malicious party could exploit the vulnerability to gain access gain access to sensitive data. Citrix has released updates to fix the vulnerability in Sharefile and Content...

Vulnerabilities fixed in VMware Aria Operations Networks

VMware has fixed vulnerabilities in Aria Operations Networks aka vRealize Network Insight. A malicious party could exploit the vulnerabilities to gain access to sensitive data, or to execute arbitrary code on the underlying system. The most serious vulnerability has been labeled CVE-2023-20887 an...

Vulnerability fixed in Sailpoint IdentityIQ

Sailpoint has fixed a vulnerability in IdentityIQ. A authenticated malicious person could exploit the vulnerability to execute arbitrary code in the application, potentially gain access to user credentials and authorization information. Sailpoint has released updates to fix the vulnerability in a...

Vulnerabilities fixed in Zyxel firewalls

Zyxel has fixed vulnerabilities in the firmware of firewall series ATP, USG FLEX, VPN and ZyWall/USG. An unauthenticated malicious party could exploit the vulnerabilities to cause a denial-of-service, and possibly also to execute arbitrary execute arbitrary code on the vulnerable system. Zyxel ha...

Vulnerability fixed in Dradis Pro

Dradis has fixed a vulnerability in Dradis Pro. A malicious party could exploit the vulnerability to perform a cross-site scripting attack. Such an attack can lead to execution of arbitrary code in the context of the browser of the victim, or access sensitive data within that same context of the...

Vulnerabilities fixed in Oracle MySQL

Vulnerabilities have been fixed in Oracle MySQL. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Oracle has fixed vulnerabilities in the following products: - MySQL...

Vulnerabilities fixed in Fortinet FortiSandbox

Fortinet has fixed vulnerabilities in FortiSandbox. A authenticated malicious person could exploit the vulnerabilities to execute arbitrary code, or to gain access to sensitive data from within the underlying system. Fortinet has released updates to fix the vulnerabilities in FortiSandbox. For mo...

Vulnerabilities fixed in Adobe Acrobat and Acrobat Reader

Adobe has fixed vulnerabilities in Acrobat and Acrobat Reader. A malicious party can exploit the vulnerabilities for attacks that can lead to the following categories of damage: Circumvention of security measure. Remote code execution User rights Access to sensitive data Increased user privileges...

Vulnerabilities fixed in Fortinet FortiClient

Fortinet has fixed vulnerabilities in the FortiClient. A local malicious person can exploit the vulnerabilities to grant themselves elevated privileges, be able to create arbitrary files be able to create arbitrary files on the underlying system and potentially execute arbitrary code execution...

Vulnerabilities fixed in Microsoft SQL Server

Microsoft has fixed vulnerabilities in MS SQL Server. The vulnerabilities allow a malicious person to execute arbitrary execute arbitrary code with SYSTEM privileges. To exploit the vulnerabilities exploit, the malicious party must trick a user of SQL Server entice a rogue query to open and...

Vulnerability fixed in Node.js vm2

A vulnerability has been fixed in vm2. vm2 is a package for Node.js and provides a sandbox environment for running untrusted code. The vulnerability allows a malicious party to to break out of the sandbox and thus execute code on the system on which vm2 is running. The way the vulnerability can b...

Vulnerability fixed in Adobe Photoshop

Adobe has fixed a vulnerability in Photoshop. A local malicious party can exploit the vulnerability to execute arbitrary code. The malicious party does not need any prior authorizations on the application. Adobe has released updates to fix the vulnerability in Photoshop 2022 v23.5.4 & 2023 v24.2....

Vulnerability fixed in FortiOS

FortiNet has fixed a vulnerability in FortiOS. The vulnerability is located in the management environment and allows an unauthenticated malicious person, with access to that management interface, be able to perform a denial-of-service on the management interface, or execute arbitrary code on the...

Vulnerabilities fixed in ClamAV

ClamAV has fixed two vulnerabilities in ClamAV. A unauthenticated remote malicious person could exploit them to obtain sensitive information, or to execute arbitrary code with privileges from ClamAV. ClamAV has released updates to fix the vulnerabilities in ClamAV 1.0.1, 0.105.2 and 0.103.8. For...

Vulnerabilities fixed in Cisco Nexus Dashboard

Cisco has fixed vulnerabilities in the Nexus Dashboard. A malicious person with access to the management environment can exploit the exploit the vulnerabilities to cause a denial-of-service, or to launch a cross-site scripting attack. execute. Such an attack could result in execution of code in t...

Vulnerabilities fixed in Apple macOS, iOS, iPadOS and Safari

Apple has fixed vulnerabilities in macOS Ventura, iOS, iPadOS and Safari for Big Sur and Monterey. A malicious party could exploit vulnerabilities to execute arbitrary code, or to gain access to sensitive data. To execute code with kernel privileges, or to gain access to sensitive data, the...

Vulnerabilities fixed in Microsoft SQL Server

Microsoft has fixed vulnerabilities in SQL Server and Power BI. An authenticated malicious person could exploit the vulnerabilities to execute arbitrary code, possibly with permissions from the server process itself. SQL Server: |----------------|------|-------------------------------------| | CV...

Vulnerability fixed in Dell EMC Networker

Dell has fixed a vulnerability in EMC Networker client. A unauthenticated malicious person could exploit the vulnerability to execute arbitrary code with application privileges. The vulnerability can be exploited when the Networker Client uses the oldauth authentication method. Dell has released...

Vulnerabilities fixed in BIND

ICS has fixed vulnerabilities in BIND. An unauthenticated malicious party could exploit the vulnerabilities to cause of a denial-of-service DoS. The vulnerability with attribute CVE-2022-3736 is present only when a BIND server uses a particular stale configuration. A malicious party in that case...

Vulnerability fixed in Tenable Nessus

A vulnerability has been fixed in Tenable Nessus. A authenticated malicious party could potentially obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host. Tenable has issued updates to fix the vulnerabilities. For more information, see: https://www.tenable.com/security/tns-2023-01...

Vulnerability found in SugarCRM

A new vulnerability may have been found in SugarCRM. The vulnerability allows an unauthenticated remote malicious person able to bypass authentication and execute arbitrary code execute arbitrary code on the Web server. The described vulnerability is said to be located in the AttachFiles action o...

Vulnerability fixed in OTRS

A vulnerability has been fixed in OTRS. The vulnerability allows an authenticated malicious person to perform an SQL injection. execute. OTRS instances are only vulnerable if the TicketSearch Web service is configured. OTRS developers have released updates to fix the vulnerability. More informati...

Vulnerability fixed in IBM Spectrum Protect Plus

A vulnerability has been fixed in IBM Spectrum Protect Plus. The vulnerability allows a malicious person to access gain access to sensitive data. The malicious party can alter the communication flow via a Man-in-the-Middle attack between Spectrum Protect Plus vSnap and associated agents because i...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in several components of Windows. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution Administrator/Root rights Remote co...

Vulnerabilities fixed in MobaXterm

Vulnerabilities have been fixed in Mobatek MobaXterm. The vulnerability allows a malicious party to bypass authentication bypass and connect unauthenticated via the SSH or SFTP protocol. Furthermore, a malicious party can perform a denial-of-service DoS exploit on the SFTP protocol. The...

Vulnerability fixed in F-Secure Policy Manager

A vulnerability has been fixed in F-Secure Policy Manager from WithSecure. The vulnerability allows an authenticated malicious person able to write files to the server on which the application is running on. This can have several possible types of impact have, such as denial of service or executi...

Vulnerability fixed in Atlassian Crowd

A vulnerability has been fixed in Atlassian Crowd. This vulnerability allows a malicious person to, through a configuration error to authenticate itself and thereby interact with the user management REST API. In doing so, the IP of the attacker must be on the allow list, which is not the default...

Vulnerabilities fixed in IBM QRadar SIEM

IBM has fixed vulnerabilities in QRadar SIEM and in the QRadar Assistant App. A malicious party could potentially exploit them for attacks that could result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitive data...

Vulnerability fixed in FortiManager and FortiAnalyzer

FortiNet has fixed a vulnerability in FortiManager and FortiAnalyzer. A malicious person with low privileges can exploit the exploit the vulnerability to perform a cross-site scripting attack via the reporting module. Such an attack can lead to the execution of arbitrary code in the context of th...