Vulnerabilities fixed in Red Hat Satellite

Vulnerabilities have been fixed in Red Hat Satellite. The vulnerabilities allow a malicious person to carry out attacks that lead to the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Remote code execution Administrator/Root rights SQL Injection Access to sensitiv...

Vulnerability fixed in Atlassian Crowd

A vulnerability has been fixed in Atlassian Crowd. This vulnerability allows a malicious person to, through a configuration error to authenticate itself and thereby interact with the user management REST API. In doing so, the IP of the attacker must be on the allow list, which is not the default...

Vulnerability fixed in RICOH Aficio SP 4210N

A vulnerability has been fixed in RICOH Aficio SP 4210N. The vulnerability allows a remote malicious person to perform a Cross-Site Scripting attack. To exploit this vulnerability exploitation requires access to the Web Image Monitor. RICOH has released updates to fix the vulnerability. More...

Vulnerabilities fixed in Heimdal

Vulnerabilities have been fixed in Heimdal, an implementation of ASN.1/DER, PFIX and Kerberos. The vulnerabilities allow a remote malicious party to potentially execute arbitrary code execute in Heimdal's Key Distribution Center KDC, obtain secret keys obtain secret keys when using 1DES, 3DES, or...

Vulnerability fixed in IBM Security Access Manager

A vulnerability has been fixed in IBM WebSphere Application Server. The vulnerability allows an authenticated remote malicious party to remote user to perform a Cross-Site Scripting attack on the admin console. IBM has released updates to fix the vulnerabilities. More information can be found on...

Vulnerabilities fixed in libxml2

Vulnerabilities have been fixed in libxml2. The vulnerabilities allow a remote malicious person to cause a denial-of-service cause. -= Debian =- Debian has made updates to libxml2 available for Debian 11.0 Bullseye to address the vulnerabilities. You can install the custom packages installed by...

Vulnerabilities fixed in Cisco ESA, SWA and Secure Email and Web Manager

Cisco has fixed several vulnerabilities in Cisco Email Security Appliance ESA, Secure Web Appliance SWA, vh. Web Security Appliance and the Secure Email and Web Manager. A malicious party could exploit the vulnerabilities to cause a denial-of-service, to execute arbitrary commands execute with ro...

Vulnerability fixed in FortiManager and FortiAnalyzer

FortiNet has fixed a vulnerability in FortiManager and FortiAnalyzer. A malicious person with low privileges can exploit the exploit the vulnerability to perform a cross-site scripting attack via the reporting module. Such an attack can lead to the execution of arbitrary code in the context of th...

Vulnerabilities fixed in OpenSSL

Vulnerabilities have been fixed in OpenSSL 3. OpenSSL is widely found on web and mail servers but is also used by other types of systems. Think of network devices, embedded systems and containerized images. The vulnerabilities can be exploited by a malicious party to execute arbitrary code or cau...

Vulnerability fixed in Expat

Expat developers have fixed a vulnerability. A malicious party could exploit the vulnerability to cause a denial-of-service, or possibly to execute arbitrary code execute arbitrary code with permissions from the application in which the libexpat library is used. The developers of expat have...

Vulnerability fixed in Rockwell Automation FactoryTalk

A vulnerability has been fixed in Rockwell Automation FactoryTalk Services Platform. The vulnerability allows an unauthenticated remote user to remote capable of performing a denial-of-service DoS. Rockwell Automation has released updates and mitigating measures released to address the...

Vulnerability fixed in Zoom

A vulnerability has been fixed in Zoom. The vulnerability allows a malicious person to bypass a security measure and gain access to sensitive data. To exploit the vulnerability, a malicious person needs to victim to open a rogue link. This enables the malicious party to perform further attacks su...

Vulnerability fixed in Bentley Systems MicroStation Connect

Two vulnerabilities have been fixed in Bentley Systems MicroStation Connect. A malicious party could potentially exploit the vulnerability to cause a denial-of-service or execute arbitrary code with the privileges of the logged in user. To do this, the malicious party needs to trick the victim in...

Vulnerability fixed in Oracle Hyperion

Oracle has fixed a vulnerability in Oracle Hyperion Infrastructure Technology. The vulnerability allows an unauthenticated remote malicious person able to execute arbitrary code to execute under the application's permissions. Oracle has fixed vulnerabilities in the following products: - Oracle...

Vulnerability fixed in FortiGate and FortiProxy

Fortinet has fixed a vulnerability in FortiGate and FortiProxy. An unauthenticated malicious party could potentially exploit the vulnerability potentially exploit it to bypass authentication on the management interface and thus perform actions perform actions normally reserved for authenticated...

Vulnerabilities fixed in Cisco products

Vulnerabilities have been fixed in several Cisco products. The vulnerabilities allow a malicious party to conduct attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution...

Vulnerability fixed in Redis

A vulnerability has been fixed in Redis. The vulnerability allows a malicious party to use heap overflow to execute arbitrary code with user privileges or a denial-of-service DoS. To exploit the vulnerability, a malicious party must issue an XAUTOCLAIM command with a rogue COUNT argument on a key...

Vulnerabilities fixed in Zoom

Vulnerabilities have been fixed in Zoom. The vulnerabilities allow a malicious person to carry out attacks that result in the following categories of damage: Manipulation of data Circumvention of security measure Accessing sensitive data The vulnerabilities with characteristics CVE-2022-28758 and...

Vulnerabilities fixed in Aruba AOS-CX switches

Vulnerabilities have been fixed in several Aruba AOS-CX switches. These vulnerabilities do not apply to wireless products. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Denial-of-Service DoS...

Vulnerability fixed in Cisco Secure Web Appliance

Cisco has fixed a vulnerability in the management interface of AsyncOS for the Secure Web Appliance. An authenticated malicious party could exploit the vulnerability to inject commands inject and execute commands with root privileges. The vulnerability can only be exploited through the management...

Vulnerability fixed in Palo Alto Pan-OS

A vulnerability has been fixed in Palo Alto PAN-OS. The vulnerability allows an unauthenticated remote malicious person able to exploit the affected Palo Alto system in a reflected denial-of-service attack on systems other than the vulnerable Palo Alto system. The attack appears to the victim the...

Vulnerabilities fixed in QNAP products

QNAP has fixed several vulnerabilities in QTS, the operating system of QNAP NAS systems. The vulnerabilities are are in the SAMBA and Kerberos software used within QTS. used within. The vulnerabilities allow a remote malicious person to able to bypass security measures and thus gain access gain...

Vulnerabilities fixed in apache OpenOffice

Apache Software Foundation has fixed vulnerabilities in OpenOffice. The vulnerabilities allow a malicious person with access to the system to retrieve user passwords stored in a user's configuration database. The vulnerabilities involve weak encryption on this configuration database. Apache has...

Vulnerabilities discovered in Siemens products

Vulnerabilities have been discovered in several Siemens industrial products. A malicious party could potentially exploit them to cause a denial-of-service, to execute code execute code in the scope of the application, or possibly open a root/admin shell to open on the vulnerable system. The...

Vulnerabilities fixed in X.Org Server

Vulnerabilities have been fixed in X.Org Server. A authenticated malicious person can exploit the vulnerabilities to execute arbitrary code. Depending on the permissions under which X.Org Server is running, this allows the malicious party to gain gain root privileges on the vulnerable system. The...

Vulnerability fixed in rsync

A vulnerability has been fixed in rsync. The vulnerability allows a malicious person to overwrite arbitrary files on the victim's system. To exploit this vulnerability exploitation, the victim must connect to a rogue rsync server. The developers of rsync have created a new version to fix the...

Vulnerabilities fixed in Foxit Reader and Foxit PDF Editor

Foxit has fixed vulnerabilities in Foxit Reader and PDF Editor formerly PhantomPDF. A malicious party could exploit them to cause a denial-of-service, to obtain obtain sensitive data, or to execute arbitrary code execute arbitrary code in the scope of the application. Foxit has released updates t...

Vulnerabilities fixed in IBM QRadar SIEM

Vulnerabilities have been fixed in IBM QRadar SIEM. A remote malicious party could, by misusing the Apache Commons Email component to obtain sensitive information or manipulate user data in SMTP headers. IBM has released updates to fix the vulnerabilities in QRadar. For more information, see:...

Vulnerability fixed in Synology DiskStation Manager

Synology has fixed a vulnerability in Diskstation Manager. The vulnerability is located in the webapi component of DiskStation Manager. An authenticated malicious party can perform a path traversal attack that results in the following categories of damage: Denial-of-Service DoS. Manipulation of...

Vulnerabilities fixed in Apple Safari

Apple has fixed several vulnerabilities in Safari. A remote malicious person could potentially exploit the vulnerabilities to execute arbitrary code in the scope of the browser, or to gain access to sensitive data in the scope of the browser. However, the malicious party must trick the victim int...

Vulnerability fixed in Confluence

A vulnerability has been fixed in Questions for Confluence, a plug-in for Confluence. An unauthenticated outside malicious person could exploit the exploit the vulnerability to see all pages of information that are visible to users within the Confluence Users user group. This is because of the us...

Vulnerabilities fixed in Oracle Primavera

Oracle has fixed vulnerabilities in the following products: Primavera Gateway Primavera P6 Enterprise Project Portfolio Management Primavera Unifier The vulnerabilities potentially enable a malicious party to execute attacks that lead to denial-of-service DoS. An overview of all fixed...

Vulnerability fixed in Oracle Essbase

Oracle has fixed a vulnerability in Essbase Server. The vulnerability potentially allows a malicious party to launch attacks execute attacks that result in the following categories of damage: Manipulation of data. Bypassing authentication Accessing sensitive data...

Vulnerabilities fixed in Elastic Kibana and Elastic Endpoint Security

Elastic has fixed vulnerabilities in Kibana and Endpoint Security for Windows. An authenticated malicious party could potentially exploit the vulnerabilities potentially exploit them to perform a cross-site scripting attack or to obtain elevated permissions. Elastic has released updates to fix th...

Vulnerability fixed in Atlassian Jira

Atlassian has fixed a vulnerability in Jira. A authenticated malicious person could exploit the vulnerability to execute a server-side request-forgery attack. This enables the malicious party to gain access to sensitive data or information about the system. The vulnerability is located in a plug-...

Vulnerability fixed in OpenSSL

A vulnerability has been fixed in OpenSSL. The vulnerability is located in the cvrehash script and is caused by the fact that shell meta-characters being insufficiently removed from user input. removed. On some operating systems, the vulnerable script is is executed automatically. On such systems...

Vulnerability fixed in Microsoft Edge

A vulnerability has been fixed in Microsoft Edge. A remote malicious person could potentially exploit the vulnerability to execute arbitrary code. Because it is possible to get out of Edge's sandbox environment, execution of code at the SYSTEM level cannot be ruled out. Abuse requires that the...

Vulnerability fixed in IBM Spectrum Protect Plus

IBM has fixed a vulnerability in Spectrum Protect Plus. Credentials of users are printed in readable text in the IBM Spectrum Protect Plus virgo log file. IBM has released updates to fix the vulnerabilities in Spectrum Protect Plus 10.1.0.0-10.1.9.32. For more information, see:...

Vulnerabilities fixed in Microsoft Edge

Vulnerabilities have been fixed in Microsoft Edge. These vulnerabilities allow a remote attacker to impersonate impersonate someone else or break outside the sandbox and thereby increase privileges. This requires a user to respond to a link from the attacker. Microsoft has made update version...

Vulnerabilities fixed in Red Hat OpenShift Container Platform

Multiple vulnerabilities have been fixed in the Red Hat OpenShift Container Platform. These vulnerabilities allow an attacker to able to perform a Cross-Site Scripting XSS attack on the subversion plugin of Jenkins or a denial-of-service DoS in GoLang. Red Hat has made updates available for Red H...

Vulnerabilities fixed in VMWare products

VMware has fixed two vulnerabilities in Workspace ONE Access, Identity Manager, vRealize Automation, Cloud Foundation and vRealize Suite Lifecycle Manager. An unauthenticated malicious person with access to the management environment could potentially exploit the vulnerabilities to gain gain...

Vulnerabilities fixed in SUSE Linux Enterprise kernel

SUSE has fixed vulnerabilities in the Linux kernel. A authenticated malicious person could potentially exploit them to cause a denial-of-service or to obtain elevated privileges. -= SUSE =- SUSE has made updates available to fix the vulnerability fixes in SUSE 12 and 15. You can install these...

Vulnerabilities fixed in Red Hat OpenShift Logging

Red Hat has fixed vulnerabilities in OpenShift Logging. A malicious party could exploit the vulnerabilities to cause a denial-of-service, bypassing a security measure or perform an HTTP request smuggling attack. Red Hat has released updates to fix the vulnerabilities. For more information, see:...

Vulnerability fixed in ecdsautils

Debian has fixed a vulnerability in ecdsautils. This is a library used for cryptographic applications based based on ECDSA. The vulnerability is in functionality for validating of ECDSA signatures. The flaw causes an application considers specially crafted signatures to be valid when they are not...

Vulnerabilities fixed in Yokogawa Centum VP, ProSafe-RS and B/M9000 VP

Yokogawa has fixed vulnerabilities in Centum VP, ProSafe-RS and B/M9000 VP. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User Rights Access t...

Vulnerability fixed in Cisco Catalyst

A vulnerability has been fixed in Cisco Catalyst. The vulnerability is located in the IOS XE software. The vulnerability allows a locally authenticated malicious person to obtain elevated permissions and execute arbitrary code with these elevated privileges. Cisco has released updates to fix the...

Vulnerability fixed in SonicWall Global VPN Client

A vulnerability has been fixed in the Global VPN Client from SonicWall. This vulnerability allows a local malicious person with elevated privileges to execute arbitrary code on the system. SonicWall has released updates to fix the vulnerability. fix. For more information, see the link below:...

Vulnerability fixed in Mattermost

A vulnerability has been fixed in Mattermost with versions lower than 6.5. Email invitations to a Mattermost channel or server are insufficiently invalidated when selected by an administrator. This allows a person to still participate in Mattermost channels even though access has been revoked aft...

Vulnerability found in 7zip for Windows

A vulnerability has been found in 7zip for Windows. This vulnerability allows a malicious person to obtain elevated privileges obtain and execute commands with these privileges. This can be accomplished by moving a file with a .7z extension to "Contents" within the "Help" menu. Within the 7z.dll ...

Vulnerabilities fixed in Apache Subversion (SVN)

Apache has fixed vulnerabilities in Subversion SVN. The vulnerabilities allow an unauthenticated remote malicious agent to remotely capable of causing a denial-of-service or obtain system information. -= SUSE =- SUSE has made updates available to fix the vulnerability in SUSE 15. fix in SUSE 15...