Vulnerabilities fixed in Acrobat Reader

Acrobat has fixed vulnerabilities in Acrobat Reader. A unauthenticated malicious person could potentially abuse them to obtain elevated privileges or to execute arbitrary code with application privileges. To exploit the vulnerabilities, the malicious party must entice the victim to open a rogue P...

Vulnerability fixed in Typo3

The developers of Typo3 have fixed a vulnerability in Typo3 core. An unauthenticated malicious person could potentially exploit the vulnerability potentially exploit it to perform a Cross-site Request Forgery and thereby trick a victim into execute code under the malicious party's control. In the...

Vulnerabilities fixed in Squid

Two vulnerabilities have been fixed in Squid. The vulnerabilities potentially allow a remote malicious party to cause a denial-of-service DoS or gain access to sensitive data. The vulnerability with reference CVE-2021-28116 is located in the way Squid handles WCCPv2 traffic. The developers of Squ...

Vulnerability fixed in AMD chipset kernel driver

AMD has fixed a vulnerability in the Windows driver for multiple chipsets. The vulnerability allows a local malicious able to obtain data. AMD categorizes this vulnerability as "medium. Proof-of-concept code is available. AMD has released updates to fix the vulnerability. More information can be...

Vulnerabilities fixed in Google Chrome

Vulnerabilities have been fixed in Google Chrome. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Access to system data Google, as usual, is releasing few technical details abou...

Vulnerability fixed in Cisco Identity Services Engine

Cisco has fixed a vulnerability in Identity Services Engine ISE. A malicious person with administrator privileges can exploit the vulnerability exploit it to perform a Cross-Site Scripting XSS attack. Such an attack can result in the execution of arbitrary script code in the browser used to visit...

Vulnerabilities fixed in XStream

Several vulnerabilities have been fixed in XStream. A malicious party could potentially exploit the vulnerabilities to cause a denial-of-service or execute arbitrary code with the application's permissions. The vulnerabilities are exploitable only when using use of the default XStream blacklist...

Vulnerabilities fixed in IBM AIX

Vulnerabilities have been fixed in IBM AIX. A local malicious party can, by exploiting these vulnerabilities, gain gain root privileges on the vulnerable system or can cause a Denial-of-Service exploit on the local system. IBM has released updates to fix the vulnerabilities in AIX. For more...

Vulnerability fixed in Atlassian Confluence

A vulnerability has been fixed in Atlassian Confluence. A malicious party could potentially exploit the vulnerability to execute arbitrary code under the application's permissions. Atlassian has released updates to fix the vulnerability in Confluence. For more information, see:...

Vulnerabilities fixed in OpenSSL

The developers of OpenSSL have fixed two vulnerabilities. The vulnerabilities allow an unauthenticated remote malicious person to remotely able to cause a denial-of-service, or potentially gain access to sensitive data, including possibly private keys currently actively in use on the system. Misu...

Vulnerability fixed in Atlassian Jira

A vulnerability has been fixed in Atlassian Jira. The vulnerability allows a remote malicious party to obtain obtain system data by performing a path-traversal. Atlassian has released updates to fix the vulnerability. fix. More information can be found on the page below:...

Vulnerability fixed in BIND

A vulnerability has been fixed in BIND. The vulnerability allows a remote malicious party the ability to cause a denial-of-service cause. The vulnerability manifests itself when the RRL functionality is enabled. By default, this is not case. ISC has released updates to fix and mitigation. More...

Vulnerabilities fixed in Mozilla Thunderbird

Mozilla has fixed vulnerabilities in Thunderbird. The vulnerabilities allow an unauthenticated remote malicious person to remote may be able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure. Remote code execution User...

Vulnerability fixed in the Linux kernel

A vulnerability has been fixed in the Linux kernel. A malicious party could potentially exploit the vulnerability to execute arbitrary code under root privileges. -= Red Hat =- Red Hat has made updates available for Red Hat Enterprise Linux 8. You can install these updates using the command 'yum'...

Apache Tomcat vulnerability discovered in BIG-IP

F5 has discovered a vulnerability in BIG-IP. The vulnerability is located in the Tomcat component and gives opportunity for HTTP request smuggling. A malicious party can modify an HTTP request of another user. This can lead to many types of consequential damage. F5 has not yet released updates to...

Vulnerability fixed in Jupyter notebook

Jupyter has fixed a vulnerability in notebook. The vulnerability is known as a so-called Cross-Site-Scripting XSS. The vulnerability allows a malicious person to execute arbitrary code under the privileges of the victim. To do this, the malicious party must induce the victim to to follow a rogue...

Multiple vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in Office products. The vulnerabilities allow a malicious person to carry out attacks execute attacks that lead to the following categories of damage: Executing arbitrary code User privileges. Impersonating another user Below is a summary of the various...

Vulnerability fixed in Dell NetWorker

Dell EMC has released updates to fix the vulnerability. For more information, see: https://www.dell.com/support/kbdoc/en-us/000185470 /dsa-2021-081-dell-emc-networker-security-update-for-a-clear-text -vulnerability...

Vulnerability fixed in Dell Avamar Server

A vulnerability has been fixed in Dell EMC Avamar Server. The vulnerability allows a malicious party to use an Open Redirect attack to send the visitor with a custom link to a malicious website. Dell EMC has released updates to fix the vulnerability. For more information, see:...

Vulnerability fixed in Apple iOS, iPadOS and macOS

A vulnerability has been fixed in iOS, iPadOS and macOS. A malicious party could potentially exploit the vulnerability to execute arbitrary code under root privileges. Apple indicates that this vulnerability may be actively abused being exploited. Apple has released updates to fix the...

Vulnerabilities fixed in Asterisk

Vulnerabilities have been fixed in Asterisk. A malicious party could potentially exploit the vulnerabilities to cause a denial-of-service cause. Asterisk Project has released updates to fix the vulnerabilities. fixes. For more information, see:...

Vulnerability fixed in MIT Kerberos

A vulnerability has been fixed in krb5, part of MIT's Kerberos. A malicious party could potentially exploit the vulnerability to cause a denial-of-service on the KDC process through a specially prepared request. -= Debian =- Debian has made updates to krb5 available for Debian 10.0 Buster to fix...

Vulnerability fixed in NetBSD

The developers of NetBSD have fixed a vulnerability in kernfs. The vulnerability allows an authenticated malicious person to able to read any files on the file system, including files both system and userspace for which the malicious party is not originally authorized. No CVE ID has been disclose...

Vulnerabilities fixed in QEMU

Vulnerabilities have been fixed in QEMU. The vulnerabilities allow a malicious party potentially capable of carrying out attacks that lead to the following categories of damage: Denial-of-Service DoS. Remote code execution with privileges of the QEMU process Access to sensitive data Access to...

Vulnerability fixed in Microsoft Dynamics

Microsoft has fixed a vulnerability in Dynamics Business Central Control. A malicious party could potentially exploit it to execute arbitrary code under the privileges of the application on the underlying operating system. Microsoft has made updates available that fix the described vulnerability...

Vulnerability fixed in Siemens SIMIT

Siemens has fixed a vulnerability in SIMIT. A malicious party could potentially exploit the vulnerability to cause a denial-of-service or to gain access to data stored in system memory. For this vulnerability, Proof-of-Concept code is publicly available. Siemens has released updates to fix the...

Actively exploited vulnerability fixed in ForgeRock AM

ForgeRock has fixed a vulnerability in ForgeRock Access Manager AM. An unauthenticated remote malicious party could potentially exploit the vulnerability potentially exploit it to execute arbitrary code under the application's permissions. To do this, malicious network traffic should be sent to a...

Vulnerabilities fixed in Node.js

Vulnerabilities have been fixed in Node.js and npm. A malicious party could potentially exploit the vulnerabilities to cause a denial-of-service in the npm client or within a service that uses node.js. Also, by exploiting the vulnerability with CVE attribute CVE-2021-22921 SYSTEM privileges gain...

Vulnerability discovered in TLS implementations

Researchers have discovered a vulnerability in the way TLS traffic is processed. The vulnerability has been named ALPACA and is caused by the fact that IP addresses and port numbers are not authenticated by TLS. A malicious party with a Man-in-the-Middle position can therefore encrypt network...

Vulnerabilities fixed in OpenVPN

Vulnerabilities have been fixed in the Windows versions of OpenVPN and OpenVPN Connect. A local malicious party could potentially exploit them to execute arbitrary code under the rights of the OpenVPN process. To do this, the malicious party must modify the OpenVPN configuration file such that th...

Vulnerability fixed in MediaWiki

A vulnerability has been fixed in MediaWiki. The vulnerability allows an authenticated remote malicious person to delete delete pages while the account is locked. MediaWiki has released new versions to fix the vulnerability. fix. More information can be found on the page below:...

Vulnerabilities fixed in Dovecot

Dovecot's developers have fixed two vulnerabilities. An authenticated remote malicious person can exploit the vulnerabilities exploit them to cause a denial-of-service, execute execute commands with application privileges or to obtain sensitive data. -= Ubuntu =- Canonical has made updates...

Vulnerability fixed in Cisco AnyConnect Secure Mobility Client

Cisco has fixed a vulnerability in AnyConnect Secure Mobility Client. A local malicious agent could potentially exploit it to execute arbitrary code under SYSTEM privileges. Only clients on which the VPN Posture HostScan Module is installed are vulnerable. Cisco has released updates to fix the...

Vulnerabilities fixed in Red Hat OpenShift

Red Hat has fixed vulnerabilities in OpenShift Container Platform. A malicious party could potentially exploit them to obtain elevated privileges on the vulnerable system or to cause a denial-of-service. -= Red Hat =- Red Hat has made updates available for Red Hat Enterprise Linux 8. You can...

Vulnerability fixed in RabbitMQ

A vulnerability has been fixed in RabbitMQ. A malicious party could potentially exploit the vulnerability to cause a denial-of-service cause by sending a rogue AMQP message to the RabbitMQ server that can receive AMQP 1.0 messages. VMware Tanzu has released updates to fix the vulnerability fix in...

Vulnerability fixed in Xerox AltaLink systems

Xerox has fixed a vulnerability in AltaLink systems. A remote malicious person could exploit the vulnerability to conduct execute a Cross-Site Scripting XSS attack. Such an attack can result in the execution of arbitrary script code in the browser used to access the system. No CVE vulnerability h...

Vulnerabilities fixed in Microsoft .NET Core and Visual Studio

Microsoft has fixed vulnerabilities in .NET Core, Visual Studio and Visual Studio Code. An unauthenticated malicious person at remote user could potentially exploit it to cause a denial-of-service. The vulnerability with attribute CVE-2021-31938 could potentially be exploited by a local malicious...

Vulnerabilities fixed in Mozilla Firefox

Mozilla has fixed vulnerabilities in Firefox. The vulnerabilities potentially allow an unauthenticated remote malicious person to able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure. Remote code execution User rights...

Vulnerability fixed in NetApp Clustered Data ONTAP

NetApp has fixed a vulnerability in Clustered Data ONTAP. A remote malicious party could potentially exploit it to cause a denial-of-service. Few substantive details about the vulnerability publicly available made available. NetApp has released updates to fix the vulnerability in Clustered Data...

Vulnerability fixed in SonicWall Network Security Manager

A vulnerability has been fixed in the SonicWall Network Security Manager. The vulnerability allows an authenticated malicious person remotely capable of injecting OS commands by sending a specially-prepared HTTP request. SonicWall has released updates to fix the vulnerability. fix. More informati...

Vulnerability fixed in Salt

A vulnerability has been fixed in Salt. A malicious person could vulnerability potentially exploit it to execute execute arbitrary code. To do this, the malicious party must have the ability to place a rogue file on a Salt monitored device. This file should then be passed through the Snapper modu...

Vulnerabilities fixed in QEMU and libvirt

Vulnerabilities have been fixed in QEMU and libvirt. The vulnerabilities allow a local, authenticated malicious person potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Access to system data Increased user privileges -= Red Hat =- Red Hat...

Vulnerability fixed in Foxit products

A vulnerability has been fixed in Foxit products. The vulnerability allows an unauthenticated remote malicious person able to cause a denial-of-service with potentially the execution of arbitrary code under user privileges. The malicious party to do this must induce the victim to open a rogue fil...

Vulnerabilities fixed in Mozilla Firefox, Firefox ESR and Thunderbird

Vulnerabilities have been fixed in Mozilla Firefox, Firefox ESR and Thunderbird. A malicious party could potentially exploit them to cause a denial-of-service or execute arbitrary execute arbitrary code with the privileges of the logged-in user. The vulnerability with CVE attribute CVE-2021-29951...

Vulnerability found in Dell firmware update driver

A vulnerability has been fixed in the Dell dbutil23.sys driver for Windows systems. This driver has been installed by default on all Dell laptop and desktop systems since 2009. A local malicious person could, by exploiting this vulnerability to gain SYSTEM privileges on the vulnerable system. For...

Vulnerabilities fixed in Google Chrome

Vulnerabilities have been fixed in Google Chrome. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights As usual, Google reveals little information...

Vulnerabilities fixed in Oracle Java SE

Vulnerabilities have been fixed in Oracle Java. The vulnerabilities allow an unauthenticated remote malicious person to obtain system data. ------------------.------.------------------------------------- | CVE ID | CVSS | Vector |. |------------------|------|-------------------------------------|...

Vulnerabilities fixed in Mozilla Firefox and Thunderbird

Mozilla has fixed several vulnerabilities in Firefox, Firefox ESR and Thunderbird. The vulnerabilities can be exploited by a malicious be exploited to cause a denial-of-service, access gain access to data in the context of the application, or to potentially execute arbitrary code with application...

Vulnerabilities fixed in McAfee Endpoint Security

Due to cleartext transfer of sensitive information between McAfee Endpoint Security ENS for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence GTI servers that use DNS use, a remote attacker can view ENS requests and responses from GTI via DNS. McAfee has released...

Vulnerability fixed in Cisco AnyConnect Secure Mobility Client

A vulnerability in the IPC channel of Cisco AnyConnect Secure Mobility Client, an authenticated, local attacker can cause a Denial-of-Service DoS exploit on an affected device. To exploit this security vulnerability, the attacker must have have valid login credentials on the device. Cisco has...