Vulnerability fixed in Ruby on Rails

A vulnerability has been fixed in Ruby on Rails. The vulnerability allows a malicious person to use an Open Redirect attack to send the visitor with a custom link to a malicious website. send. Ruby on Rails has released updates to fix the vulnerability. fix. For more information, see:...

Vulnerability fixed in Icinga

A vulnerability has been fixed in Icinga. Within Icinga TLS certificate verification is used. However However, the validity of the Certificate Authority is not checked. A malicious party can thus circumvent bypass security. Updates have been released to fix the vulnerabilities. More information c...

Vulnerabilities fixed in multiple implementations of HTTP/2

A PortSwigger researcher has discovered vulnerabilities in several implementations of HTTP/2. The researcher has demonstrated that it is possible to manipulate HTTP/2 requests. When the front-end of an application uses HTTP/2 and forwards the request to the back-end a downgrade to HTTP/1 takes...

Vulnerability fixed in Firefox and Thunderbird

Mozilla has fixed a vulnerability in Thunderbird and Firefox. The vulnerability can be exploited with a so-called HTTP Response Splitting attack. In this attack, the malicious party manages to replace the original content of an HTTP response with rogue content. Mozilla has released updates to fix...

Vulnerability fixed in SSSD

A vulnerability has been fixed in SSSD. The vulnerability allows a local malicious person with permissions on the SSSD interface e.g., via sudo to obtain root privileges. -= Oracle =- Oracle has made updates available for Oracle Linux 8. You can install these updates using the command 'yum'. More...

Vulnerabilities fixed in Node.js

Vulnerabilities have been fixed in Node.js. The vulnerabilities potentially enable a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Scripting XSS. Denial-of-Service DoS. Circumvention of security measure. Remote code execution User Rights The...

Vulnerabilities fixed in Mozilla Firefox

Mozilla has fixed vulnerabilities in Firefox and Firefox Extended Support Release ESR. The vulnerabilities allow an unauthenticated remote malicious party potentially able to perform attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure...

Vulnerabilities fixed in Oracle Linux microcode

Vulnerabilities have been fixed in the Oracle Linux microcode. The vulnerabilities allow a malicious party to access system data and increased user privileges. -= Oracle =- Oracle has made updates available for Oracle Linux 7 and 8. U can install these updates using the command 'yum'. More...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Google Chrome. The vulnerabilities allow a malicious person to carry out attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Google has released updat...

Vulnerabilities fixed in Mozilla Thunderbird

Mozilla has fixed vulnerabilities in Thunderbird. The vulnerabilities allow an unauthenticated remote malicious person to remote may be able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure. Remote code execution User...

Vulnerability fixed in Cacti

Vulnerabilities have been fixed in Cacti. A malicious person at remote can exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. Such an attack can lead to the execution of arbitrary script code in the browser used to visit the application is visited. Not every vulnerability h...

Vulnerabilities fixed in GitLab

Vulnerabilities have been fixed in GitLab. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS Denial-of-Service DoS. Circumvention of security measure. Remote code execution Use...

Vulnerabilities fixed in QEMU

Vulnerabilities have been fixed in QEMU. The vulnerabilities allow a malicious person to perform attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Access to system data -= SUSE =- SUSE has made updates available to fix the...

Vulnerability fixed in libgcrypt

The developers of GnuPG have fixed a vulnerability in libgcrypt. The vulnerability is caused by an insecure implementation of ElGamal cryptography. A malicious person could potentially exploit the vulnerability to perform a side-channel attack against data encrypted using ElGamal. Few substantive...

Vulnerabilities fixed in Broadcom Symantec products

Broadcom has fixed vulnerabilities in Symantec products. The vulnerabilities allow a malicious party to cause a denial-of-service and to obtain sensitive data obtain. Broadcom has been sparse in making information available regarding the vulnerabilities. Broadcom has released updates to address t...

Vulnerability fixed in Xterm

The developers of Xterm have fixed a vulnerability. The vulnerability can be exploited by an unauthenticated malicious person at a remote user to cause a Denial-of-Service, or possibly executing arbitrary code with the privileges of the process. -= SUSE =- SUSE has made updates available to fix t...

Vulnerabilities fixed in IBM Spectrum Protect Client

Vulnerabilities have been fixed in IBM Spectrum Protect Client. A malicious party could potentially exploit the vulnerability to cause a denial-of-service or execute arbitrary code with the application's permissions. IBM has released updates to fix the vulnerabilities. For more information, see:...

Vulnerability fixed in IBM Integration Bus

A vulnerability has been fixed in IBM Integration Bus. A malicious party could potentially exploit the vulnerability in the Javascript lodash module potentially exploit it to execute arbitrary commands on the underlying system. IBM has released updates to fix the vulnerability. For more...

Vulnerability fixed in polkit

A vulnerability has been fixed in polkit, an integral part of several Linux distributions. A local malicious person could gain root privileges by exploiting this vulnerability on the vulnerable system. GitHub has published more information about this vulnerability. For more information see:...

Vulnerability fixed in HPE OneView for VMware vCenter

HPE has fixed a vulnerability in OneView for VMware vCenter. An unauthenticated remote malicious agent could exploit it to perform a Cross-Site Scripting XSS attack. Such an attack could result in the execution of arbitrary script code in the browser used to visit the application visited. HPE has...

Vulnerability fixed in Redis

A vulnerability has been fixed in Redis. A malicious person at remote user could potentially exploit the vulnerability to execute arbitrary execute arbitrary code under application privileges. The vulnerability is caused by an integer overflow that can be triggered via the command "STRALGO LCS" c...

Vulnerabilities fixed in the Linux kernel

Vulnerabilities have been fixed in the linux kernel. The vulnerabilities allow a local malicious agent to launch attacks execute attacks that lead to the following categories of damage: Denial-of-Service DoS Remote code execution Administrator/Root privileges Increased user privileges -= Ubuntu =...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Chrome. The vulnerabilities potentially enable a remote malicious person to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Accessing...

Vulnerability fixed in Red Hat OpenShift Container Platform

A vulnerability has been fixed in runc, a component of Red Hat OpenShift Container Platform. The vulnerability allows a malicious user under certain circumstances to themselves, through a rogue container image, to gain access to the host's file system. For more information about the vulnerability...

Vulnerability fixed in Confluence

A vulnerability has been fixed in JIRA. The vulnerability allows a local malicious agent the ability to execute arbitrary code execute under application privileges. JIRA has released updates to fix the vulnerability. More information can be found on the page below:...

Legal vulnerabilities fixed in RedHat AMQ Streams

Red Hat has fixed vulnerabilities in AMQ Stream 1.6.4. A malicious party could exploit the vulnerabilities to cause a denial-of-service, or gain access via path-traversal to potentially sensitive data. -= Red Hat =- Red Hat has made updates available for Red Hat AMQ Stream. U can install these...

Vulnerabilities fixed in Exim

Vulnerabilities have been fixed in Exim. Collectively, these vulnerabilities named "21nails." The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS Remote code execution Administrator/Root rights Remote code executio...

Vulnerabilities fixed in GitLab CE and EE

GitLab has fixed several vulnerabilities in GitLab Community Edition and Enterprise Edition. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Accessing sensitive da...

Vulnerability fixed in DB2

IBM has fixed a vulnerability in DB2 including DB2 Connect Server. Because of incorrect file permissions, a local malicious party is able to manipulate arbitrary files and gain access to system data and sensitive data. IBM has released updates to fix the vulnerability in DB2. For more information...

Vulnerabilities fixed in Apple Safari

Vulnerabilities have been fixed in Apple Safari. The vulnerabilities potentially allow a remote malicious person to execute arbitrary execute arbitrary code in the context of the browser if he manages to induce the user to visit a rogue page. Also, a malicious party in this way can cause the syst...

Vulnerabilities fixed in Oracle JD Edwards

Vulnerabilities have been fixed in Oracle JD Edwards. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to sensitive data...

Vulnerability fixed in x.org

A vulnerability has been fixed in X.org. A malicious person could exploit the vulnerability to appropriate elevated privileges within the X server and thus potentially execute arbitrary code with application privileges. Under usual circumstances, an X server runs with limited permissions. -= Debi...

Vulnerability fixed in IBM WebSphere Application Server

IBM has fixed a vulnerability in WebSphere Application Server. It involves an XML External Entity Injection XXE vulnerability. An unauthenticated remote malicious person could potentially exploit the vulnerability to gain access to sensitive data. In addition, the vulnerability could be exploited...

Vulnerability fixed in DELL PowerEdge and X-series

DELL has fixed a vulnerability in the firmware of their PowerEdge and X-series systems. Weak encryption allowed an unauthenticated malicious person to obtain the login credentials of another user and thereby gain elevated privileges. DELL has released updates to fix the vulnerability in PowerEdge...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in the Chrome browser. A unauthenticated remote malicious person could potentially exploit them to execute arbitrary code under the rights of the application. To do this, the malicious party needs to victim to visit a rogue Web page. Google has indicated that for...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Chrome. The vulnerabilities allow a remote malicious person to cause a denial-of-service or to obtain system data obtain. To do so, the malicious party must induce the victim to to visit a rogue website. Google has released updates to fix the vulnerabilities...

Vulnerability fixed in Apple iOS and iPadOS

A vulnerability has been fixed in Apple iOS and Apple iPadOS. The vulnerability is located in the WebKit component and is referred to as Universal Cross-site Scripting UXSS. The vulnerability allows an unauthorized remote malicious person to execute arbitrary code under browser privileges. The...

Vulnerability found in ProFTPd

A vulnerability has been found in ProFTPd. An unauthenticated malicious party can remotely exploit the vulnerability to cause a denial-of-service attack. No CVE ID issued. ProFTP has not yet released updates to address the vulnerability. fix in ProFTPd...

Vulnerability fixed in GitLab

GitLab developers have fixed a serious vulnerability fixed in GitLab Community Edition and Enterprise Edition. The vulnerability allows an authenticated malicious person to execute arbitrary code on the server. A CVE ID has been requested for this vulnerability but has not yet been assigned. GitL...

Vulnerabilities fixed in NetBSD

The developers of NetBSD have fixed a number of vulnerabilities fixed in NetBSD's IP stack. Because packet IDs are not randomly are not randomly generated by default, a malicious party can predict the IP traffic. predict, allowing the malicious party to launch a man-in-the-middle attack to obtain...

Vulnerability fixed in GNU git

GNU has fixed a vulnerability in git. A malicious person could exploit the vulnerability to create a rogue repository from which scripts are automatically executed upon check out. This allows the malicious party to execute arbitrary code with permissions of git on the vulnerable system. GNU has...

Vulnerabilities fixed in Glibc

Vulnerabilities have been fixed in Glibc. The vulnerabilities allow an unauthenticated remote malicious agent the ability to launch a Denial-of-Service attack, possibly resulting in the execution of arbitrary code as a result. -= Ubuntu =- Canonical has made updates available for Ubuntu 16.04 LTS...

Vulnerability fixed in Xerox products

A vulnerability has been fixed in Xerox Phaser, WorkCentre and VersaLink. The vulnerability allows a malicious person to execute arbitrary code under the user's privileges. Xerox did not release any substantive details about this vulnerability. No CVE attribute has been assigned to this...

Vulnerabilities fixed in GRUB2

Vulnerabilities have been fixed in GRUB2. The vulnerabilities allow a local malicious person to execute arbitrary code resulting in the circumvention of "Secure Boot." Also, the vulnerabilities can be used to cause a denial-of-service cause. With the exception of the vulnerability with attribute...

Vulnerability fixed in OpenSSH

A vulnerability has been fixed in OpenSSH. The vulnerability allows a malicious party with access to the SSH agent socket to cause a Denial-of-Service and potentially execute arbitrary code. execute. No CVE attribute has been reserved for this vulnerability yet. The developers of OpenSSH have...

Vulnerabilities fixed in Veritas Backup Exec

Veritas has fixed three vulnerabilities in Veritas Backup Exec. The vulnerabilities allow an unauthenticated remote malicious person to remotely able to execute commands under SYSTEM privileges on systems on which a Veritas Backup Exec Agent is installed. In addition, the vulnerabilities can be...

Vulnerabilities fixed in LibTIFF

Vulnerabilities have been fixed in LibTIFF. The vulnerabilities enable an unauthenticated remote malicious agent to opportunity to cause a denial-of-service or potentially execute arbitrary code under user privileges. The malicious party to do this must induce the victim to open a rogue TIFF file...

Vulnerability fixed in NetApp products

A vulnerability has been fixed in NetApp products. The vulnerability allows an unauthenticated remote malicious person able to use a so-called man-in-the-middle attack to obtain to obtain sensitive data. Exploiting this vulnerability requires expertise. NetApp has released updates to fix the...

Vulnerability fixed in OpenLDAP

A vulnerability has been fixed in OpenLDAP. The vulnerability allows an unauthenticated remote malicious party to cause a denial-of-service attack. The developers of OpenLDAP have released updates to fix the vulnerability. More information can be found at the page below:...

Vulnerabilities fixed in PHP

Several vulnerabilities have been fixed in PHP. The vulnerabilities potentially enable an unauthenticated remote malicious person to able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Spoofing Access to sensitive data -= Debian =- Debian has made updat...