Vulnerabilities fixed in Schneider Electric PowerLogic

Schneider Electric has fixed vulnerabilities in a number of PowerLogic products. An unauthenticated malicious person at remote could potentially exploit the vulnerabilities to cause a denial-of-service or to execute arbitrary code. Schneider Electric has released updates to address the...

Vulnerabilities fixed in Microsoft Browsers

Two vulnerabilities have been fixed in Microsoft Internet Explorer. The vulnerabilities allow a malicious person to execute arbitrary code under a user's privileges. To exploit the vulnerabilities, an attacker must trick the entice the victim to open a rogue page. According to Microsoft, the...

Vulnerability fixed in FortiGate

Fortinet has fixed a vulnerability in FortiGate. The vulnerability allows an unauthenticated remote malicious person potentially able to bypass the proxy by sending non-HTTPS traffic such as SSH to port 80/443 of FortiGate. Fortinet has released updates to fix the vulnerability in FortiGate 6.4.3...

Vulnerability fixed in Keycloak

A vulnerability has been fixed in Keycloak. The vulnerability allows a malicious party to bypass authentication. Red Hat has released updates to fix the vulnerability. More information can be found on the pages below: https://issues.jboss.org/browse/KEYCLOAK-14090...

Vulnerabilities fixed in Salt

Vulnerabilities have been fixed in Salt. Salt is used used in VMware vRealize Operations Manager and RSA NetWitness. The vulnerabilities allow a malicious party to carry out attacks execute attacks that lead to the following categories of damage: Bypassing authentication Bypassing security measur...

Vulnerabilities fixed in VMware ESXi and vSpher

VMware has fixed vulnerabilities in ESXi and vCentre vSphere. The vulnerabilities allow a malicious person to execute arbitrary code on ESXi and vCentre. Also, the the vulnerabilities allow the malicious party to launch a Cross-Site Request Forgery attack on vCentre. It is good practice to unlock...

Vulnerability fixed in Atlassian Jira

A vulnerability has been fixed in Jira. The vulnerability allows unauthenticated a malicious person to gain access to system data Atlassian has released updates to fix the vulnerability. fix. More information can be found on the page below: https://jira.atlassian.com/browse/JRASERVER-72014...

Vulnerability fixed in BIND

A vulnerability has been fixed in ISC BIND. A malicious party could potentially exploit the vulnerability to cause a denial-of-service cause. This vulnerability can only be exploited when BIND is configured to make use of GSS-TSIG. This is not the default configuration. In environments where BIND...

Vulnerabilities fixed in QEMU

Several vulnerabilities have been fixed in QEMU. A malicious person within a QEMU VM could potentially exploit the vulnerabilities to gaining access to sensitive data or to cause a denial-of-service. -= Ubuntu =- Canonical has made updates available for Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS and...

Vulnerability found in Adobe ColdFusion

A vulnerability has been found in Adobe ColdFusion. Due to an error in the permissions structure, a local malicious agent can place a specially prepared DLL file to execute arbitrary code under SYSTEM privileges. For more information, see the page below: https://www.kb.cert.org/vuls/id/125331 At...

Vulnerabilities fixed in sudo

Several vulnerabilities have been fixed in sudo. A local malicious party can, by exploiting these vulnerabilities, gain gain root privileges on the vulnerable system. The developers of sudo have released updates to fix the vulnerability marked CVE-2021-3156 in version 1.9.5p2. The vulnerabilities...

Vulnerabilities fixed in Oracle Hyperion

Oracle has fixed vulnerabilities in the following Oracle Hyperion products: Hyperion Infrastructure Technology Hyperion Financial Reporting The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to launch attacks execute attacks that...

Vulnerability fixed in Oracle Java SE

Oracle has fixed vulnerabilities in the following Oracle Java products: Java SE JDK and JRE The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to system data. Only applications that execute untrusted code e.g., using third-party...

Vulnerabilities fixed in Oracle Database Server

Oracle has fixed vulnerabilities in the following Oracle Database Server products: Database - Enterprise Edition Text Advanced Networking Option Application Express APEX PERL The vulnerabilities allow an unauthenticated malicious person with network access to the vulnerable system may be able to...

Vulnerability fixed in McAfee Agent

McAfee has fixed a vulnerability in McAfee Agent. Due to a flaw in the permissions structure, a local malicious agent can disrupt the operation of Agent by manipulating a directory used by Agent used for temporary files. The result of this is that Agent continues to work, but no longer processes...

Vulnerability fixed in the Fedora Linux kernel

Fedora developers have fixed a vulnerability in the Linux kernel they use. The vulnerability allows an authenticated remote malicious person to obtain to obtain sensitive information and to manipulate data. -= Fedora =- Fedora has made updates available for Fedora 32 and 33. You can install these...

Vulnerability discovered in Schneider Electric EcoStruxure Control Expert

Vulnerabilities have been discovered in Schneider Electric EcoStruxure Control Expert. The vulnerabilities allow a local malicious able to cause a denial-of-service and to execute arbitrary execute arbitrary code by opening a rogue file. Schneider Electric categorizes this vulnerability according...

Vulnerabilities fixed in Dovecot

A malicious party could exploit the vulnerabilities to cause a denial-of-service and to read e-mail from other users. Dovecot has released updates to fix the vulnerabilities. For more information, see the following pages: CVE-2020-24386:...

Vulnerability found in Kubernetes

A vulnerability has been found in Kubernetes that allows a malicious person capable of performing a man-in-the-middle attack on the traffic within a cluster. By advertising an external IP address or by claiming a load balancer IP, traffic can be redirected to the attacker. However, the malicious...

Vulnerabilities fixed in XStream

Vulnerabilities have been fixed in XStream. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Request Forgery XSRF. Manipulation of data Access to sensitive data The vulnerabilities are exploitable only when using the defau...

Vulnerability fixed in IBM Tivoli Netcool Impact

A vulnerability has been fixed in IBM Tivoli Netcool Impact. A malicious party can exploit the vulnerability to circumvent bypass security measures and obtain sensitive data via phishing. sensitive data. IBM has released updates to fix the vulnerability in Tivoli Netcool Impact 7.1.0.20. For more...

Vulnerabilities fixed in Mozilla Firefox

Mozilla has fixed several vulnerabilities in Firefox. A malicious party can exploit the vulnerabilities to launch attacks that lead to the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Remote code execution User rights Spoofing Accessing sensitive data T...

Vulnerability fixed in Apple MacOS Server

A vulnerability has been fixed in Apple MacOS Server. The vulnerability potentially allows a remote malicious party to perform execute a cross-site scripting attack or the ability to exploit an open-redirect vulnerability to be exploited. Apple has released updates to fix the vulnerability. More...

Vulnerabilities fixed in Foxit Reader and Foxit PhantomPDF

Foxit has fixed vulnerabilities in Foxit Reader and Foxit PhantomPDF. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Foxit has released...

Vulnerability fixed in Apache Struts

A vulnerability has been fixed in Apache Struts. The vulnerability allows an unauthorized remote malicious person to execute arbitrary code under privileges of the Struts application. To exploit the vulnerability, the OGNL evaluation must be be enabled. Apache has released a new version to fix th...

Vulnerabilities fixed in NetApp products

The makers of NetApp products have incorporated new versions of Eclipse Jetty server and Python into their products. With these, the release of sensitive information, the addition or modification of data or denial of service DoS is prevented. Netapp has released updates to fix the vulnerabilities...

Vulnerability fixed in Netapp products

A vulnerability has been fixed in Jackson databind, used by several Netapp products. The vulnerability allows a malicious party to execute arbitrary code under the user's privileges and to obtain sensitive data. The vulnerabilities stem from the failure to adequately validate user input prior to...

Vulnerabilities fixed in Xerox WorkCentre

Vulnerabilities have been fixed in Xerox WorkCentre. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Manipulation of data Access to sensitive data No CVE numbers a...

Vulnerabilities fixed in Firefox, Firefox ESR and Thunderbird

Vulnerabilities have been fixed in Mozilla Firefox, Firefox ESR and Thunderbird. The vulnerabilities allow a malicious person to perform attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Circumvention of security measure. Remote code...

Vulnerabilities fixed in OpenLDAP

Several vulnerabilities have been fixed in OpenLDAP. The vulnerabilities allow an unauthenticated malicious person with network access to the OpenLDAP server is able to cause a denial-of-service on the OpenLDAP service. Exploit code is publicly available for both vulnerabilities. The operation of...

Vulnerabilities fixed in PAN OS

Palo Alto has fixed several vulnerabilities in PAN OS. The most serious vulnerability, with attribute CVE-2020-2050, is rated by Palo Alto rated with a CVSS score of 8.2 and is located in the GlobalProtect SSL VPN component. An unauthenticated malicious party can remotely exploit this vulnerabili...

Vulnerabilities fixed in Chrome

Google has released a new version of Chrome that fixes two vulnerabilities are fixed. A malicious party could vulnerabilities potentially exploit them to execute arbitrary code with the victim's privileges. Google reports being aware that the vulnerabilities are in limited extent being exploited ...

Vulnerability fixed in Adobe Reader Mobile

A vulnerability has been fixed in Adobe Reader Mobile for Android. A malicious party could exploit the vulnerability to gain access to sensitive data in the context of the victim. Adobe has released updates to fix the vulnerability in Reader Mobile 20.9.0. For more information, see:...

Multiple vulnerabilities fixed in Adobe Reader

Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. Successful misuse can lead to the execute arbitrary code in the context of the current user. Adobe developers have made updates available for Adobe Reader to fix the vulnerabilities. For more information see:...

Vulnerability fixed in Red Hat Jboss Enterprise Application Platform

A vulnerability has been fixed in Red Hat Jboss Enterprise Application Platform. The vulnerability allows a remote malicious person to remotely able to manipulate data and thereby cause a Denial-of-Service. Red Hat has released updates to fix the vulnerability in. More information can be found on...

Vulnerabilities fixed in MariaDB

Vulnerabilities have been fixed in MariaDB. The vulnerabilities allow a malicious person to perform a denial-of-service execution. In the case of the vulnerability with attribute CVE-2020-13249, it also involves an attack from the network. -= Ubuntu =- Canonical has made updates available for...

Vulnerabilities fixed in Oracle Solaris

Oracle has fixed several vulnerabilities in Solaris. By exploiting the vulnerabilities, an unauthorized malicious person can gain remote access to the system. It also allows local users bypass security measures or cause a denial-of-service. Oracle has released updates to fix the vulnerabilities...

Vulnerabilities fixed in VMware Horizon Server and Client

Vulnerabilities have been fixed in VMware Horizon Server and Client. The vulnerabilities allow a malicious party to access system data and to execute arbitrary code under the user's privileges. VMware has released updates to fix the vulnerabilities. More information can be found on the page below...

Vulnerabilities fixed in Oracle Java SE

Oracle has fixed vulnerabilities in the following Oracle Database products: Oracle Java SE JDK Oracle Java SE JRE Oracle Java Oracle Java Web Start The vulnerabilities allow an unauthenticated remote malicious person to remote may be able to launch attacks that result in the following categories ...

Vulnerabilities fixed in IBM Security Access Manager

IBM has fixed multiple vulnerabilities in IBM Security Access Manager. The vulnerabilities potentially enable a malicious person to able to launch attacks that result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Manipulation of data Circumvention of...

Vulnerability fixed in Blackberry Unified Endpoint Management

Blackberry has fixed a vulnerability in Blackberry Unified Endpoint Management UEM. A malicious party with network access to the UEM server could potentially exploit the vulnerability to cause a denial-of-service exploit on UEM Core. Blackberry has released updates to fix the vulnerability fix in...

Vulnerability fixed in PowerDNS

A vulnerability has been fixed in PowerDNS. The vulnerability allows an authenticated malicious person with access to the control panel or the REST API to gain access to system data. obtain. PowerDNS has released updates to fix the vulnerability. More information can be found on the page below:...

Vulnerabilities fixed in MediaWiki

Vulnerabilities have been fixed in MediaWiki. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Circumvention of security measure Remote code execution User Rights Access to system data MediaWiki has released...

Vulnerabilities fixed in libxml2

Vulnerabilities have been fixed in libxml2. The vulnerabilities allow a malicious party to perform a denial-of-service DoS execution. The developers of libxml12 categorize these vulnerabilities according to the CVSSv3 method with a highest score of 7.5. FreeBSD has released updates to fix the...

Vulnerabilities fixed in Oracle Unbreakable Enterprise Kernel

Oracle has fixed several vulnerabilities in the Unbreakable Enterprise Kernel. The vulnerabilities allow a malicious potentially able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Access to system data...

Vulnerability fixed in Microsoft SQL Server Reporting Services

There is a vulnerability in Microsoft SQL Server Reporting Services SSRS. The vulnerability exists in the Reporting Service instance due to incorrect validation of attachments to reports. If successfully exploited, the vulnerability enables an authenticated malicious person able to add unauthoriz...

Vulnerability fixed in IBM Aspera Connect

IBM has fixed a vulnerability in Aspera Connect. The vulnerability allows an unauthenticated remote malicious person able to execute arbitrary code under privileges of the application. To do so, the malicious party must induce the victim to execute load a rogue dynamic-link library. IBM has...

Vulnerabilities fixed in FreeBSD

The developers of FreeBSD have fixed several vulnerabilities fixed in several network modules used by FreeBSD. used. A malicious party on the local network could potentially exploit the vulnerabilities potentially exploit them to cause a denial-of-service cause or execute arbitrary code with the...

Vulnerability in Autodesk 3ds max actively exploited

Autodesk says it is actively observing abuse of a vulnerability in 3ds max software. A variant of the MAXScript exploit "PhysXPluginMfx" allows a remote malicious person to to execute arbitrary code within the context of the application. To do this, the malicious party must entice the victim to...

Vulnerabilities fixed in Firefox and Firefox ESR

Vulnerabilities have been fixed in Firefox and Firefox ESR. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure. Remote code execution User rights Access to...