Vulnerability fixed in Sophos SG UTM

A vulnerability has been fixed in Sophos SG UTM. The vulnerability allows a remote malicious person to execute arbitrary code execute arbitrary code with user privileges. It is good practice to access the management interface to be exposed on a local network to which only administrators have acce...

Vulnerabilities fixed in Xen

Xen developers have fixed vulnerabilities in the hypervisor. The vulnerability with reference CVE-2020-25604 makes it possible for a local malicious person who can migrate timers between vCPU-s to cause a denial-of-service. The vulnerability with attribute CVE-2020-25595 allows a local malicious...

Vulnerabilities fixed in libxml2

Vulnerabilities have been fixed in libxml2. The vulnerabilities allow a malicious party to perform a denial-of-service DoS execution. The developers of libxml12 categorize these vulnerabilities according to the CVSSv3 method with a highest score of 7.5. FreeBSD has released updates to fix the...

Vulnerability fixed in WebSphere Application Server Admin Console

IBM has fixed a vulnerability in the WebSphere Application Server Admin Console. The attack that can exploit this vulnerability exploit is referred to as Cross-Site Scripting. The vulnerability allows an unauthenticated remote malicious person is able to execute arbitrary code in the browser of t...

Vulnerabilities fixed in IP stack of various SIEMENS products

Siemens has fixed two vulnerabilities in the Linux IP stack of various industrial products. An unauthenticated malicious person could exploit the vulnerabilities to cause a denial-of-service cause. The malicious party must have access to the production network. It is good practice not to have suc...

Vulnerabilities fixed in Microsoft Dynamics

Microsoft fixes multiple vulnerabilities in Microsoft Dynamics 365 products. The vulnerabilities in Microsoft Dynamics 365 on-premises and Microsoft Dynamics 365 for Finance and Operations on-premise allow a malicious party to execute arbitrary code or perform Cross-Site Scripting XSS attack. The...

Vulnerability fixed in Microsoft SQL Server Reporting Services

There is a vulnerability in Microsoft SQL Server Reporting Services SSRS. The vulnerability exists in the Reporting Service instance due to incorrect validation of attachments to reports. If successfully exploited, the vulnerability enables an authenticated malicious person able to add unauthoriz...

Vulnerability discovered in several Siemens products

Researchers have revealed that several Industrial products from Siemens are vulnerable to the so-called "CrossTalk" vulnerability in Intel Processors. A local malicious person with the rights to install software can exploit the vulnerability to gain access gain access to sensitive data. To do so,...

Vulnerability fixed in OpenSUSE

SUSE has made available an update to fix a vulnerability in the Linux kernel. The vulnerability allows a locally authenticated malicious person able to obtain elevated user privileges to obtain. See "Possible fixes" for more information. The developers of OpenSUSE have made updates available to f...

Vulnerability fixed in Atlassian Jira

Vulnerable versions of Atlassian Jira Server and Data Center allow a remote malicious person to enumerate project keys via a vulnerability in the /browse.PROJECTKEY endpoint. Atlassian has made version 8.12.0 of Jira available. More information can be found on the following page:...

Vulnerabilities fixed in the X11 server

SUSE has fixed three vulnerabilities in the x.org X11 server. A malicious party could potentially exploit the vulnerabilities to bypass security measures and gain access to system data and/or memory. -= SUSE =- SUSE has made updates available to fix the vulnerabilities in SUSE 12 and 15. fixes in...

Vulnerabilities fixed in Squid

Squid's developers have fixed three vulnerabilities. Of one vulnerability no CVE-id is known. The vulnerabilities allow a remote malicious party the ability to use cache poisoning to potentially gain access to sensitive data, or to cause a Denial-of-Service. The developers have released updates t...

Vulnerability fixed in GitLab

A vulnerability has been fixed in GitLab Enterprise Edition. A malicious party could exploit the vulnerability to obtain of sensitive information. GitLab has released updates to fix the vulnerability. More information can be found on the page below: https://about.gitlab.com/releases/2020/08/18...

Vulnerability fixed in Chrome

Google has released a new version of Chrome. At this time not all details are known and Google only names one specific vulnerability which they themselves rate as "High. This concerns a Heap buffer overflow vulnerability, which could potentially be be exploited by a malicious party to execute...

Vulnerabilities fixed in SNMP

Debian has fixed vulnerabilities in SNMP. The vulnerabilities allow a locally authenticated malicious person to obtain elevated privileges. -= Debian =- Debian has made updates to net-snmp available for Debian 10.0 Buster to address the vulnerabilities. You can install the custom packages install...

Vulnerability fixed in IBM WebSphere Application Server

A vulnerability has been fixed in IBM WebSphere Application Server. The vulnerability allows an unauthenticated malicious person remotely capable of executing arbitrary code on the system. IBM indicates that to exploit this vulnerability, an undocumented change must be made by the administrator o...

Vulnerability fixed in SAP S/4 HANA

SAP has fixed a vulnerability in SAP S/4 HANA. By exploiting this vulnerability, a malicious person with user privileges remotely bypass authentication and make data make data inaccessible. SAP has made an update available to fix the vulnerability fix, see for more information:...

Vulnerabilities fixed in Google Chrome

Google has fixed several vulnerabilities in Chrome. Little little substantive information made publicly available. It is possible that a malicious party could exploit the vulnerabilities to execute arbitrary code with user privileges or for causing a denial-of-service on the Web browser. Google h...

Vulnerability fixed in Kubernetes

A vulnerability has been fixed in Kubernetes. The vulnerability allows an authenticated malicious person with root privileges on a node to gain elevated privileges on other nodes running in the same cluster running. With these elevated rights to take over pods on the affected nodes. When multiple...

Vulnerability fixed in ntpd

A vulnerability has been fixed in the ntp client daemon. The vulnerability allows an unauthenticated remote malicious person able to perform a denial-of-service attack. The developers of ntpd have released updates to fix the vulnerability. More information can be found on the pages below:...

Vulnerability fixed in VLC

VideoLan has fixed a vulnerability in VLC Media Player. The vulnerability allows an unauthenticated remote malicious person able to cause a denial-of-service, and potentially execute arbitrary code with privileges of the affected user. To do so, the malicious party must entice the victim to open ...

Vulnerabilities fixed in Samba

Vulnerabilities have been fixed in Samba. A malicious party can exploit the exploit the vulnerabilities to cause a denial-of-service or to execute arbitrary code with the permissions of the user under which the Samba server is running. More information about the vulnerabilities can be found on th...

Vulnerability fixed in Linux kernel

SUSE has fixed a vulnerability in SUSE Kernel. The vulnerability causes in certain cases IPv6 traffic to be is not encrypted over an IPsec tunnel. A malicious party could potentially be able to retrieve sensitive data as a result. -= SUSE =- SUSE has made updates available to fix the vulnerabilit...

Vulnerability fixed in Ruby JSON gem

A vulnerability has been fixed in the JSON gem that is provided by default included in the Ruby installation. The vulnerability allows a malicious party to perform attacks that can lead to the following categories of damage: Manipulation of data. Remote code execution User rights Ruby has release...

Vulnerabilities in Qt 5 libraries

Vulnerabilities have been fixed in the Qt 5 software library. The vulnerabilities allow a locally authenticated malicious agent to able to establish a denial-of-service and execute arbitrary code execute arbitrary code under user privileges. -= Ubuntu =- Canonical has made updates available for...

Vulnerabilities fixed in Samba

Samba's developers have fixed three vulnerabilities. The vulnerabilities allow a malicious party to access gain access to system data, potentially gain elevated privileges or cause a denial-of-service. Samba has released updates to fix the vulnerabilities in Samba server v4.0 and 4.9. For more...

Vulnerability fixed in libssh

A vulnerability has been fixed in libssh. The vulnerability allows a remote malicious person to execute arbitrary code execute arbitrary code under the user's privileges. libssh has made updates available to fix the vulnerability. fix. More information can be found on the page below:...

Vulnerability fixed in Grafana

Grafana Labs has fixed a vulnerability in Grafana. The vulnerability allows an unauthenticated remote malicious person capable of causing a denial-of-service. The vulnerability is located in the HTTP API. Grafana Labs has made updates available to fix the vulnerability fix. More information can b...

Vulnerability fixed in libSSH2

A vulnerability has been fixed in libSSH2. The vulnerability can lead to the release of sensitive information or a denial-of-service. -= SUSE =- SUSE has made updates available to fix the vulnerability fix in SUSE 12. You can install these custom packages using 'YaST'. You can also download the...

Vulnerability fixed in OpenSSL

The developers of OpenSSL have mitigated a vulnerability. The vulnerability consists of some implementations of OpenSSL, the configuration file and possibly executables of OpenSSL can be modified by a local malicious person logged in as a user logged in. The developers indicate that the number of...

Vulnerabilities fixed in libSSH2

There are vulnerabilities in libSSH2. LibSSH2 is a client side C library for implementing the SSH2 protocol. A malicious person in control of a compromised SSH server can construct a follow-up attack on systems that have connected to the compromised SSH server. Misuse could potentially lead to th...

Vulnerabilities fixed in Adobe Acrobat Reader

Adobe has fixed vulnerabilities in Acrobat Reader Specifically for versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier. The vulnerabilities include a Use After Free, out-of-bounds write, out-of-bounds read and NULL Pointer Dereference. These vulnerabilities can lead to the execution of...

Vulnerabilities fixed in Rsync

Rsync Project has fixed vulnerabilities in Rsync versions 3.4.0. The most critical vulnerabilities in Rsync include a heap-based 'buffer overflow' CVE-2024-12084 and an 'info leak' CVE-2024-12085 that can lead to arbitrary code execution present in Rsync versions 3.2.7 & 3.3.0. In addition, there...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Chrome. A malicious party can exploit the most serious vulnerability CVE-2024-10487 to execute arbitrary code on the system on which the browser is installed via an out-of-bounds write. To do this, the victim only needs to visit an infected website or website...

Vulnerabilities fixed in Mozilla Firefox and Thunderbird

Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Cross-Site-Scripting XSS. Denial-of-Service DoS. Access to sensitive data Mozilla has released updates to fix t...

Vulnerabilities fixed in Ivanti Cloud Services Appliance

Ivanti has fixed vulnerabilities in Cloud Services Appliance v 4.6. A malicious party could exploit the vulnerabilities to execute a command-injection via path-traversal, allowing the system to be operated and possibly taken over without prior authentication. Ivanti says it has information that t...

Vulnerabilities fixed in RoundCube Webmail

Vulnerabilities have been fixed in RoundCube Webmail. A malicious party could exploit the vulnerabilities to launch a Cross-Site Scripting attack. Such an attack could lead to execution of arbitrary code in the victim's browser, or access to sensitive data in the context of the victim's browser...

Vulnerabilities fixed in Oracle Enterprise Manager

Vulnerabilities have been fixed in Oracle Enterprise Manager. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Denial-of-Service DoS. Access to sensitive data Access to system data Manipulation of data Oracle has made updates...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server. The vulnerability is located in the Power BI Client JavaScript SDK and allows a malicious party to gain access to sensitive data. Successful exploitation requires the malicious party to trick the deceive the victim into visiting a page with...

Vulnerability fixed in Microsoft Exchange

Microsoft has fixed a vulnerability in Exchange Server. A malicious party can exploit the vulnerability to execute arbitrary code execute with privileges of the victim, potentially gaining access gain access to sensitive data in the victim's context. Successful exploitation requires the malicious...

Vulnerability fixed in Microsoft Windows Defender

Microsoft has fixed a vulnerability in Defender for Endpoint. A local malicious agent could exploit the vulnerability to execute arbitrary code with SYSTEM privileges and thus potentially gain access to sensitive data on the system. Microsoft has made updates available that fix the described...

Vulnerabilities fixed in several Docker tools

Vulnerabilities have been fixed in Docker Moby, Docker desktop, runc and buildkit. A malicious party could exploit the vulnerabilities through a rogue docker image to gain elevated privileges within the environment and thus gain access to sensitive data or execute arbitrary code on the host where...

Vulnerabilities fixed in Mozilla Firefox and Thunderbird

Mozilla has fixed vulnerabilities in Firefox, Firefox ESR and Thunderbird. A malicious party could exploit the vulnerabilities to perform attacks that can lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Spoofing...

Vulnerabilities fixed in Cacti

The developers of Cacti have fixed several vulnerabilities in Cacti. A malicious party can exploit the vulnerabilities to execute attacks that can result in the following categories of damage: SQL Injection Cross-Site Scripting XSS Remote code execution User rights Remote code execution...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server. A malicious party can exploit the vulnerability to use a Man-in-the-Middle attack to intercept and decrypt, potentially gaining access to the sensitive data in that traffic. Abuse is not easily accomplished and requires the malicious party is in...

Vulnerability fixed in ProFTPd

A vulnerability has been fixed in ProFTPd. The vulnerability allows an authenticated remote malicious person to perform a denial-of-service DoS via a specially prepared command to cause a denial-of-service DoS cause. The developers of ProFTP have released updates to fix the vulnerability. For mor...

Vulnerability fixed in Google Chrome

Google has fixed a vulnerability in Chrome. The vulnerability is located in WebRTC, and a malicious person could exploit it to execute arbitrary code in the context of the browser. Google reports being aware that exploit code is being shared in limited shared. This exploit code is not yet publicl...

Vulnerability fixed in Apache ActiveMQ

Apache Foundation has fixed a vulnerability in ActiveMQ. A authenticated malicious person could exploit the vulnerability to execute arbitrary code with application privileges. Apache Foundation has released updates to fix the vulnerability fix in ActiveMQ 5.16.6, 5.17.4, 5.18.0 & 6.0.0. For more...

Vulnerabilities fixed in MediaWiki

Vulnerabilities have been fixed in MediaWiki. A malicious party can exploit the vulnerabilities to cause a denial-of-service cause, or to launch a Cross-Site-Scripting attack XSS which may allow the malicious party to grant itself elevated privileges when the administrator of a wiki allows XML...

Vulnerabilities fixed in Foxit PDF Reader and PDF Editor

Foxit has fixed vulnerabilities in PDF Reader and PDF Editor formerly PhantomPDF. A malicious party could exploit them to cause a denial-of-service, execute arbitrary execute arbitrary code with the victim's privileges or to access gain access to sensitive data in the victim's context. Successful...