Vulnerabilities fixed in Oracle Enterprise Manager

Oracle fixed vulnerabilities in Oracle Enterprise Manager A malicious party could exploit the vulnerabilities to gain access to sensitive data or cause a Denial-of-Service. Oracle has released updates to fix the vulnerabilities. See attached references for more information...

Vulnerability fixed in Adobe After Effects

Adobe has fixed a vulnerability in Adobe After Effects Specifically for versions 24.6.2, 25.0.1 and earlier. The vulnerability is in the way Adobe After Effects handles files. When a user opens a maliciously crafted file, it can cause a buffer overflow, which can result in the execution of...

Vulnerabilities fixed in Palo Alto PAN OS

Palo Alto Networks has actively fixed exploited vulnerabilities in PAN-OS. UPDATE Public PoC has now appeared to exploit CVE-2024-0012. The vulnerability with attribute CVE-2024-0012 allows a malicious person with access to the management web interface to gain administrator privileges. Through th...

Vulnerabilities fixed in Microsoft SQL Server

Microsoft has fixed vulnerabilities in SQL Server. A malicious person could exploit the vulnerabilities to execute arbitrary SQL code on the database environment. With the exception of the vulnerabilities marked CVE-2024-49021 and CVE-2024-49043, the vulnerabilities are in the SQL Native Client...

Vulnerabilities fixed in Foxit PDF Editor and PDF Reader

Foxit has fixed vulnerabilities in PDF Editor and PDF Reader. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or potentially execute arbitrary code in the context of the application, potentially gaining access to sensitive data. Successful exploitation requires t...

Vulnerability fixed in Kubernetes

A vulnerability has been fixed in Kubernetes. The vulnerability is in the ingress-nginx module and allows a malicious person with permissions to create ingress objects to bypass a security measure to execute arbitrary code with permissions from the ingress-nginx controller. In a standard...

Vulnerabilities fixed in Ivanti Avalanche

Ivanti has fixed vulnerabilities in Avalanche. A malicious party could exploit the vulnerabilities to cause a denial-of-service, access sensitive data and potentially execute arbitrary code on the system. To successfully achieve code execution, the malicious party must have elevated privileges...

Vulnerability fixed in OpenSSH

The developers of OpenSSH have fixed a vulnerability in OpenSSH The vulnerability allows a malicious party to execute arbitrary code with privileges of the sshd process without prior authentication. It cannot be ruled out that the ssh process is running with elevated privileges, making it possibl...

Vulnerability fixed in QlikSense Enterprise

A vulnerability has been fixed in QlikSense Enterprise. A malicious person can exploit the vulnerability to grant themselves elevated privileges, potentially executing arbitrary code on the system on which QlikSense is installed. For successful misuse, the malicious party must have prior...

Vulnerability fixed in Microsoft Azure

Microsoft has fixed a vulnerability in Azure Migrate. A malicious party could exploit the vulnerability to launch a Cross-Site Scripting attack. Such an attack can lead to execution of arbitrary code in the browser of the victim, or access sensitive data in the context of the victim's browser of...

| Vulnerability fixed in Ivanti Standalone Sentry

A vulnerability has been fixed in Ivanti Standalone Sentry. A malicious party can exploit the vulnerability to execute arbitrary code execute arbitrary code on the underlying operating system of the vulnerable appliance. Successful misuse does not require prior authentication, but it does require...

Vulnerability fixed in CheckMK

A vulnerability has been fixed in the CheckMK Windows Agent. The vulnerability allows an authenticated local malicious agent to able to execute with arbitrary code under higher privileges. CheckMK has released updates to fix the vulnerability. For more information, see:...

Vulnerabilities fixed in ConnectWise ScreenConnect

Connectwise has fixed vulnerabilities in ScreenConnect. A unauthenticated malicious person could exploit the vulnerabilities to create a new administrator account. An exploit is available that makes the chance of exploitation significant. At this no CVEs have yet been assigned to the...

Vulnerabilities fixed in ISC BIND

ISC has fixed vulnerabilities in BIND. A malicious party can exploit the exploit the vulnerabilities to cause a denial-of-service. ISC has released updates to fix the vulnerabilities in BIND 9.19.21, 9.18.24 S1, 9.16.48 S1 For more information, see: https://kb.isc.org/docs/cve-2023-4408...

Vulnerabilities fixed in Oracle PeopleSoft

Oracle has fixed vulnerabilities in PeopleSoft Enterprise PeopleTools. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or to gain access to sensitive data. Causing a Denial-of-Service does not require prior authentication is required. Successful access to sensiti...

Vulnerabilities fixed in Citrix Hypervisor

Citrix has released an update to fix vulnerabilities in Citrix hypervisor. The vulnerability with reference CVE-2023-23583 allows a local malicious party to use a virtual guest system to compromise the host system via PCI passthrough. This vulnerability is only present when the vulnerable product...

Vulnerability fixed in VMware Cloud Director Appliance

VMware has discovered a vulnerability in Cloud Director Appliance. A workaround for this has been published. The vulnerability occurs only when Cloud Director Appliance has received an upgrade to 10.5.0 from a lower version. Newly installed systems running on 10.5.0, or systems running on older...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious party could exploit the vulnerabilities to circumvent a security measure or execute arbitrary code with application privileges. Successful exploitation requires the malicious party to trick the victim into opening a rogue...

Vulnerability fixed in Atlassian Confluence

Atlassian has fixed a vulnerability in Confluence Data Center and Confluence Server. A malicious party could exploit it to cause a denial-of-service, or execute arbitrary execute arbitrary code on the system that Confluence is installed on. is installed on. Atlassian reports that no misuse has be...

Vulnerability fixed in Apache ActiveMQ

The Apache Foundation has fixed a vulnerability in ActiveMQ. A malicious party could exploit the vulnerability to execute arbitrary execute arbitrary code on the system where ActiveMQ is installed. Apache Foundation has released updates to fix the vulnerability fix in ActiveMQ 5.15.16, 5.16.7,...

Vulnerability fixed in Oracle Supply Chain

Oracle has fixed a vulnerability in Agile PLM. A malicious party could exploit the vulnerability to gain sensitive information or full access to all data accessible to Oracle Agile PLM accessible data. Oracle has fixed the vulnerability in the following product: - Oracle Agile PLM...

Vulnerability fixed in Trend Micro Apex One

Trend Micro has fixed a vulnerability in Apex One. A local, authenticated malicious party can exploit the vulnerability exploit to execute arbitrary code with permissions from the system. For successful abuse, the malicious party must have prior sufficient privileges on the admin console of the...

Vulnerabilities fixed in Zoho ManageEngine Password Manager pro

Zoho has fixed vulnerabilities in ManageEngine Password Manager pro. An authenticated malicious person could exploit them to bypass a security measure, manipulate data manipulate data for which the malicious party is not authorized, and gain access to sensitive data. No CVE ID has been disclosed...

Vulnerability fixed in Veritas NetBackup

Symantec has fixed a vulnerability in Veritas NetBackup. The vulnerability is located the BPCD process and allows an unauthenticated malicious person to upload and execute with permissions from the backup process. No CVE ID has been disclosed for this vulnerability yet. Symantec has released...

Vulnerabilities fixed in Oracle Enterprise Manager

Vulnerabilities have been fixed in Oracle Enterprise Manager products. A malicious party can exploit the vulnerabilities to execute attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights Access to...

Vulnerabilities fixed in IBM MQ

IBM has fixed vulnerabilities in MQ, in both the appliance and the server software. A malicious party could exploit them to cause a denial-of-service DoS, gain access gain access to sensitive data in the queue or to execute arbitrary execute arbitrary code with user privileges. IBM has released...

Vulnerability fixed in TOPdesk

TOPdesk has fixed a vulnerability in TOPdesk Self-service and TOPdesk Operator. A malicious party with a valid account can exploit the exploit the vulnerability to impersonate any other user and thus gain access to and manipulate their data. manipulate. The vulnerability lies in the way SAML Sing...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Chrome. A malicious person could exploit the vulnerabilities to cause a denial-of-service cause or potentially execute arbitrary code with privileges of the victim. Google has released updates to fix the vulnerabilities in Chrome 114.0.5735.133 for linux and...

Vulnerability fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed a vulnerability in GitLab 16.0.0. A unauthenticated remote malicious person could exploit to gain access to arbitrary files on the server via a path traversal. The vulnerability is exploitable when the malicious party has knowledge has knowledge of an attachment in a public proje...

Vulnerabilities fixed in Oracle MySQL

Vulnerabilities have been fixed in Oracle MySQL. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Oracle has fixed vulnerabilities in the following products: - MySQL...

Vulnerabilities fixed in Oracle Construction and Engineering

Oracle has fixed vulnerabilities in Primavera P6 Enterprise Project Portfolio Management and Primavera Unifier. The vulnerability with reference CVE-2022-27404 allows an unauthenticated malicious party to execute arbitrary code under the rights of the application...

Vulnerability fixed in Adobe Photoshop

Adobe has fixed a vulnerability in Photoshop. A local malicious party can exploit the vulnerability to execute arbitrary code. The malicious party does not need any prior authorizations on the application. Adobe has released updates to fix the vulnerability in Photoshop 2022 v23.5.4 & 2023 v24.2....

Vulnerabilities fixed in Redis

Redis has fixed two vulnerabilities. A malicious party can exploit the exploit the vulnerabilities to cause a denial-of-service. Because Redis is widely used as a message broker to support of information exchange processes, the consequence of a Denial-of-Service on the Redis service cannot be...

Vulnerability fixed in Joomla!

Joomla has fixed a vulnerability. An unauthenticated remote malicious person could exploit the vulnerability to gain access to vulnerable servers without prior authentication to gain access to vulnerable web endpoints. The consequential damage depends on the endpoint and could potentially lead to...

Vulnerabilities fixed in ImageMagick

Several vulnerabilities have been fixed in ImageMagick. A malicious party could potentially exploit the vulnerabilities to cause a denial-of-service or to gain access to sensitive data. To do this, the malicious party must have a specially prepared file to be processed by ImageMagick. Canonical h...

Vulnerabilities fixed in OpenSSL

The developers of OpenSSL have fixed several vulnerabilities fixed. A malicious party could exploit the vulnerabilities to cause a denial-of-service by offering manipulated certificates causing the OpenSSL system to crash. Under specially prepared circumstances, where the malicious party has...

Vulnerability fixed in Atlassian Jira

Atlassian has fixed a vulnerability in Jira Service Management Server and Data Center. The vulnerability allows a malicious party able to obtain a user's signup token and thus obtain a user's signup token and thereby bypass authentication. To obtain a signup token, a malicious party must gain...

Vulnerabilities fixed in GitLab CE and EE

Vulnerabilities have been fixed in GitLab Enterprise Edition EE and Community Edition CE. The vulnerabilities potentially enable a malicious person to execute Remote code execution. GitLab has released updates to fix the vulnerabilities in GitLab EE and CE 15.7.5, 15.6.6, and 15.5.9. For more...

Vulnerabilities fixed in Oracle Fusion Middleware

Oracle has fixed vulnerabilities in Fusion Middleware products, including WebLogic Server and HTTP Server. A unauthenticated malicious person could potentially exploit them to execute arbitrary code. To do so, it would need to malicious network traffic should be sent to the vulnerable system. sen...

Vulnerabilities fixed in ImageMagick

Several vulnerabilities have been fixed in ImageMagick. A malicious party could potentially exploit the vulnerability to cause a Denial-of-Service. To do this, the malicious party needs to have a specially prepared file to be processed by the victim. Given the use of ImageMagick, it is possible...

Vulnerabilities found in Microsoft Exchange Sever

GTSC, a Vietnamese security company has found vulnerabilities in Microsoft Exchange Server 1. The vulnerabilities allow a malicious party able to execute a Server-Side Request Forgery and to execute arbitrary code. The vulnerabilities have similarities to the Exchange vulnerability from 2021 call...

Vulnerabilities fixed in NetApp Active IQ Unified Manager

NetApp has fixed vulnerabilities in the Spring Security component of Active IQ Unified Manager for Windows, Linux, and VMware vSphere. The vulnerabilities allow a malicious party to execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data...

Vulnerabilities fixed in Foxit PDF Editor

Vulnerabilities have been fixed in Foxit PDF Editor. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service, to obtain sensitive data, or to execute arbitrary code in the scope of the application. This requires the malicious party to trick the victim into opening a rogue...

Vulnerabilities fixed in Red Hat OpenShift Container Platform

Red Hat has released updates to Red Hat OpenShift Container Platform to address several vulnerabilities in underlying software modules fixes. A malicious party could potentially exploit the vulnerabilities to cause the following categories of damage: Denial-of-Service DoS Manipulation of data...

Vulnerability fixed in Palo Alto Pan-OS

A vulnerability has been fixed in Palo Alto PAN-OS. The vulnerability allows an unauthenticated remote malicious person able to exploit the affected Palo Alto system in a reflected denial-of-service attack on systems other than the vulnerable Palo Alto system. The attack appears to the victim the...

Vulnerabilities fixed in Drupal

Drupal developers have fixed multiple vulnerabilities in Drupal core. The vulnerabilities can lead to the following categories of damage: Remote code execution Administrator/Root permissions. Access to sensitive data Increased user privileges Cross-Site Scripting XSS The vulnerability with...

Vulnerabilities fixed in Citrix Hypervisor

Vulnerabilities have been fixed in Citrix Hypervisor and Citrix XenServer. The vulnerabilities potentially enable a malicious party to able to derive memory content from another virtual machine. These vulnerabilities are only present when the vulnerable products are used on AMD Zen 1 or AMD Zen 2...

0Day vulnerability discovered in Atlassian Confluence

A 0Day vulnerability has been discovered in Atlassian Confluence Server and Confluence Datacenter. An unauthenticated malicious party can exploit the vulnerability to execute arbitrary code with application privileges and thus also gain access to sensitive data within the scope of the affected...

Vulnerabilities fixed in Microsoft Edge

Vulnerabilities have been fixed in Microsoft Edge. These vulnerabilities allow a remote attacker to impersonate impersonate someone else or break outside the sandbox and thereby increase privileges. This requires a user to respond to a link from the attacker. Microsoft has made update version...

Vulnerabilities fixed in Red Hat OpenShift Logging

Red Hat has fixed vulnerabilities in OpenShift Logging. A malicious party could exploit the vulnerabilities to cause a denial-of-service, bypassing a security measure or perform an HTTP request smuggling attack. Red Hat has released updates to fix the vulnerabilities. For more information, see:...