Vulnerabilities fixed in OpenLDAP

Vulnerabilities have been fixed in OpenLDAP. The vulnerabilities allow an unauthenticated remote malicious person to cause a denial-of-service. The developers of OpenLDAP have released updates to fix the vulnerabilities. More information can be found on the pages below:...

Vulnerability fixed in Libgcrypt

A vulnerability has been fixed in Libgcrypt. The vulnerability allows a remote malicious person to execute arbitrary code execute under the user's privileges. The developers of GnuPG have released updates to fix the vulnerability. More information can be found at the page below:...

Vulnerability fixed in Linux kernel

A vulnerability has been fixed in the Linux kernel. A malicious party can exploit the vulnerability to obtain sensitive information via a "path traversal" attack that allows security measures can be bypassed. The vulnerability can only be exploited when the target system provides a file system to...

Vulnerabilities fixed in Mozilla Thunderbird

Mozilla has fixed several vulnerabilities in Thunderbird. The vulnerabilities potentially enable a remote malicious person to able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution User Rights Access to sensitive data Access to system...

Vulnerabilities fixed in OpenShift Container Platform

Red Hat has fixed multiple vulnerabilities in OpenShift Container Platform. A remote malicious party can exploit the exploit the vulnerabilities to gain access to sensitive information. Red Hat has released updates to fix the vulnerabilities in OpenShift Container Platform 3.11.374. For more...

Vulnerability fixed in IBM Integration Bus

A vulnerability has been fixed in IBM Integration Bus. The vulnerability allows a remote malicious party to cause a Denial-of-Service or execute arbitrary code under the user's privileges. IBM has released updates to fix the vulnerability. More information can be found on the page below:...

Vulnerability fixed in Ubuntu kernel

Canonical has fixed a vulnerability in the Ubuntu kernel. The vulnerability allows an authenticated remote malicious party to opportunity to obtain sensitive information and to manipulate data manipulate. -= Ubuntu =- Canonical has made updates available for Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS...

Vulnerability fixed in Cacti

A vulnerability has been fixed in Cacti. The vulnerability allows a remote malicious person the ability to launch an SQL-Injection attack execute. Cacti has released updates to fix the vulnerability. More information can be found on the page below: https://github.com/Cacti/cacti/issues/4022...

Vulnerability fixed in Microsoft Malware Protection Engine

Microsoft has fixed a vulnerability in Microsoft System Center Operations Manager. A remote malicious party could potentially exploit the vulnerability potentially exploit it to execute arbitrary code with user privileges or to access gain access to, and manipulate, sensitive information. Microso...

Vulnerability fixed in Microsoft SQL server

There is a vulnerability in Microsoft SQL Server. A authenticated malicious party can send data over a network to an affected SQL Server when it is configured to running an Extended Event session. SQL Server: |----------------|------|-------------------------------------| | CVE ID | CVSS | Impact...

Vulnerability fixed in Microsoft Edge

There is a vulnerability in Microsoft Edge. The vulnerability allows a malicious party to execute arbitrary execute arbitrary code with user privileges. The vulnerability arises by improper handling of objects in memory. Microsoft has made updates available that fix the described vulnerabilities...

Vulnerabilities fixed in Oracle Linux

Vulnerabilities have been fixed in Oracle Linux. The vulnerabilities allow a malicious person to perform attacks that lead to the following categories of damage: Denial-of-Service DoS. Access to system data Increased user privileges Oracle has released updates to fix the vulnerabilities. More...

Vulnerabilities fixed in Google Chrome

Vulnerabilities have been fixed in Google Chrome. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure As usual, Google reveals little information regarding the details of the...

Fixed an issue in Citrix ADC and Citrix Gateway

Citrix has fixed an issue in ADC and Gateway which can lead to denial-of-service attacks. A malicious party could potentially potentially misuse DTLS to cause a Denial-of-Service. Abuse can only occur when DTLS is enabled. Citrix reports that limited scale attacks are currently being reported whi...

Vulnerability fixed in Grafana Enterprise

Several vulnerabilities have been fixed in Grafana. A malicious party could potentially exploit the vulnerabilities to bypassing authentication when Security Assertion Markup Language SAML is used as the authentication method. In addition the vulnerabilities could potentially be exploited for oth...

Vulnerabilities fixed in Google Chrome

Vulnerabilities have been fixed in Google Chrome. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights As usual, Google reveals little information...

Vulnerability fixed in Thunderbird

When reading status codes from the SMTP server, Thunderbird an integer to a position on the stack that is is intended to contain only one byte. Depending on the processor architecture and the stack layout, this leads to corruption of the stack that could potentially be abused. Mozilla has release...

Vulnerabilities fixed in NetApp products

Several NetApp products contain FasterXML jackson-databind. FasterXML jackson-databind versions 2.x prior to 2.9.10.4 are susceptible to vulnerabilities that, when successfully exploited, can lead to disclosure of sensitive information, addition or modification of data, or denial of service DoS...

Vulnerability fixed in Drupal

A vulnerability has been fixed in Drupal. A malicious party could potentially exploit the vulnerability to execute arbitrary PHP code execute under the application's permissions. To do so, the malicious party needs to upload a rogue .tar, .tar.gz, .bz2, or .tlz file uploaded to the Drupal server...

Vulnerabilities fixed in PHPMyAdmin

Ubuntu has fixed several vulnerabilities in the phpmyadmin package. The vulnerabilities allow an unauthenticated malicious party potentially able to launch attacks that lead to the following categories of damage: Cross-Site Request Forgery XSRF. Cross-Site Scripting XSS SQL Injection Access to...

Vulnerabilities fixed in libexif

Several vulnerabilities have been fixed in libexif. A malicious party could potentially exploit the vulnerabilities to cause a denial-of-service or execute arbitrary code with the application's permissions. To do this, the malicious party must use the vulnerable application to have rogue image da...

Vulnerability fixed in Citrix Hypervisor

A vulnerability has been fixed in Citrix Hypervisor. The vulnerability allows a malicious party capable of running code with elevated privileges on a guest VM able to execute execute arbitrary code with elevated privileges on the host. This vulnerability can only be exploited if a host...

Vulnerabilities fixed in PostgreSQL

Several vulnerabilities have been fixed in PostgreSQL. A local malicious person with limited privileges within the vulnerable PostgreSQL database, could potentially exploit the vulnerabilities to within the database or on the local system to execute arbitrary code execute arbitrary code with root...

Vulnerabilities fixed in Red Hat kernel

Red Hat has fixed vulnerabilities in its kernel. The vulnerabilities allow a locally authenticated malicious agent to the opportunity to cause a denial-of-service and obtain obtain system data. The vulnerability with attribute CVE-2020-12351 is a regression vulnerability of the vulnerability with...

Vulnerabilities fixed in NetApp products

NetApp has fixed vulnerabilities in several products. The vulnerabilities allow an unauthenticated remote malicious person to remotely able to obtain system information and to launch a Cross-Site Scripting attack. NetApp has made updates available for Django. See "Possible Solutions" for more...

Vulnerability fixed in IBM WebSphere Application Server

A vulnerability has been fixed in IBM WebSphere Application Server. The vulnerability allows a remote malicious person to gain access to system data. IBM has released updates to fix the vulnerability. More information can be found on the page below: https://www.ibm.com/support/pages/node/6356083...

Vulnerabilities fixed in Google Chrome

Google has fixed several vulnerabilities in Chrome. The vulnerabilities potentially allow a remote malicious person to able to perform a denial-of-service attack or to execute arbitrary execute arbitrary code under the user's privileges. As usual, Google has made little substantive information...

Vulnerability fixed in NSS

A vulnerability has been fixed in NSS. The vulnerability allows a remote malicious party capable of performing a denial-of-service attack perform on servers compiled with the NSS library by sending sending multiple ChangeCipherSpec messages. Mozilla has released updates to fix the vulnerability...

Vulnerability fixed in FreeType

A vulnerability has been fixed in FreeType. The vulnerability allows a remote malicious person to execute arbitrary code execute under the user's privileges. FreeType has released an update to fix the vulnerability. fix. More information can be found on the pages below:...

Vulnerabilities fixed in Xen

Vulnerabilities have been fixed in Xen. The vulnerabilities allow a malicious party the ability to cause a denial-of-service or to obtain elevated privileges. Xen has released updates to fix the vulnerabilities. More information can be found on the pages below: x86 PV guest INVLPG-like flushes ma...

Vulnerabilities fixed in the Debian kernel

Debian has fixed vulnerabilities in the kernel. The vulnerabilities allow a remote malicious person to opportunity to obtain system data via Bluetooth and to cause a denial-of-service potentially resulting in the execution of arbitrary code as a result. Also, the vulnerabilities enable the...

Vulnerabilities fixed in Ubuntu kernel

Canonical has fixed vulnerabilities in the Ubuntu kernel. The vulnerabilities allow a remote malicious person to opportunity to obtain system data via Bluetooth and to cause a denial-of-service potentially resulting in the execution of arbitrary code as a result. -= Ubuntu =- Canonical has made...

Vulnerabilities fixed in Red Hat kernel

Vulnerabilities have been fixed in the Red Hat kernel. The vulnerabilities allow a malicious person to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Access to system data Increased user privileges -= Red Hat =- Red Hat has made updates...

Vulnerability fixed in Windows

Microsoft has fixed a vulnerability in the Windows Codecs Library. Users who had installed the HEVC codec from the Microsoft Store had installed it were vulnerable to the execution of arbitrary code by a remote malicious person. The malicious party to do this must induce the victim to play a rogu...

Vulnerabilities fixed in PowerDNS

Vulnerabilities have been fixed in PowerDNS. The vulnerabilities allow a malicious party to cause a denial-of-service cause or to bypass a security measure. -= openSUSE =- The developers of openSUSE have made updates available to fix the vulnerability in openSUSE Leap 15.1. You can install these...

Vulnerabilities fixed in kernel

Vulnerabilities have been fixed in the openSUSE kernel. The vulnerabilities allow a malicious party to obtain to obtain system information and to cause a denial-of-service cause. -= openSUSE =- The developers of openSUSE have made updates available to fix the vulnerability in openSUSE Leap 15.1...

Vulnerability fixed in containerd

A vulnerability has been fixed in containerd, which is used by Docker and Kubernetes, among others. A malicious party could vulnerability potentially exploit it to gain access to login credentials to an internal or external image registry. To do so the malicious party must induce the user to pull...

Vulnerabilities fixed in BIND

Several vulnerabilities have been fixed in BIND. A unauthenticated remote malicious person could potentially exploit them to cause a denial-of-service of the DNS service. cause. To do this, rogue network traffic should be sent to the BIND server. -= SUSE =- SUSE has made updates available to fix...

Vulnerabilities fixed in phpMyAdmin

Two vulnerabilities have been fixed in phpMyAdmin. A remote malicious party could exploit the vulnerabilities to execute an SQL injection or Cross-Site Scripting XSS attack. To exploit the XSS vulnerability, the malicious party must create a persuade phpMyAdmin user to open a rogue URL. XSS can...

Vulnerability fixed I IBM WebSphere Application Server

IBM has fixed a vulnerability in WebSpere Application Server. The vulnerability allows an unauthenticated malicious person remotely able to obtain system data. IBM categorizes this vulnerability according to the CVSSv3 method with a score of 5.3. IBM has released updates to fix the vulnerability...

Vulnerabilities fixed in Red Hat ipa

Vulnerabilities have been fixed in Red Hat ipa. The vulnerabilities allow an unauthenticated malicious person to execute arbitrary code on the victim's browser. To do this, the malicious party must trick the victim into following a rogue hyper-link to follow. In addition, the vulnerabilities enab...

Vulnerability fixed in Sophos SG UTM

A vulnerability has been fixed in Sophos SG UTM. The vulnerability allows a remote malicious person to execute arbitrary code execute arbitrary code with user privileges. It is good practice to access the management interface to be exposed on a local network to which only administrators have acce...

Vulnerabilities fixed in Ansible

Vulnerabilities have been fixed in Ansible. The vulnerabilities allow a malicious party to gain access to sensitive and system data. Ansible has released updates to fix the vulnerabilities. More information can be found on the pages below: CVE-2020-1736:...

Vulnerabilities fixed in IP stack of various SIEMENS products

Siemens has fixed two vulnerabilities in the Linux IP stack of various industrial products. An unauthenticated malicious person could exploit the vulnerabilities to cause a denial-of-service cause. The malicious party must have access to the production network. It is good practice not to have suc...

Vulnerability fixed in Microsoft SQL Server Reporting Services

There is a vulnerability in Microsoft SQL Server Reporting Services SSRS. The vulnerability exists in the Reporting Service instance due to incorrect validation of attachments to reports. If successfully exploited, the vulnerability enables an authenticated malicious person able to add unauthoriz...

Vulnerability discovered in several Siemens products

Researchers have revealed that several Industrial products from Siemens are vulnerable to the so-called "CrossTalk" vulnerability in Intel Processors. A local malicious person with the rights to install software can exploit the vulnerability to gain access gain access to sensitive data. To do so,...

Vulnerability fixed in OpenSUSE

SUSE has made available an update to fix a vulnerability in the Linux kernel. The vulnerability allows a locally authenticated malicious person able to obtain elevated user privileges to obtain. See "Possible fixes" for more information. The developers of OpenSUSE have made updates available to f...

Vulnerabilities fixed in the X11 server

SUSE has fixed three vulnerabilities in the x.org X11 server. A malicious party could potentially exploit the vulnerabilities to bypass security measures and gain access to system data and/or memory. -= SUSE =- SUSE has made updates available to fix the vulnerabilities in SUSE 12 and 15. fixes in...

Vulnerabilities fixed in Squid

Squid's developers have fixed three vulnerabilities. Of one vulnerability no CVE-id is known. The vulnerabilities allow a remote malicious party the ability to use cache poisoning to potentially gain access to sensitive data, or to cause a Denial-of-Service. The developers have released updates t...

Vulnerability fixed in Chrome

Google has released a new version of Chrome. At this time not all details are known and Google only names one specific vulnerability which they themselves rate as "High. This concerns a Heap buffer overflow vulnerability, which could potentially be be exploited by a malicious party to execute...