Announcements

Progress Telerik has released a security update to address a critical vulnerability affecting Progress Telerik Report Server versions prior to 2024 Q2 (10.1.24.709). The addressed vulnerability could allow the remote attacker to execute arbitrary code and gain access to the affected system. Progress Telerik OS Remote Code Execution Vulnerability (CVE-2024-6327): CVSS: 9.9 Attack Vector: Network […]

SolarWinds has released security updates to address several vulnerabilities affecting SolarWinds Access Rights Manager. information, bypass security restrictions, or execute arbitrary code and gain access to the affected system by sending a specially crafted request. Sample of the addressed vulnerabilities: 1. SolarWinds Access Rights Manager Remote Code Execution Vulnerability (CVE-2024-23469): CVSS: 9.6 Attack Vector: Adjacent

Cisco has released security updates to fix several vulnerabilities across multiple Cisco products. The addressed vulnerabilities could allow the attacker to change the password of the users including administrative users, bypass security restrictions, perform spoofing attacks, cause denial of service attacks, elevate privileges to root, redirect the users to a malicious web page, obtain sensitive

Oracle released its critical patch updates for July 2024, containing (386) new security patches for multiple affected products in Oracle code and third-party components. The addressed vulnerabilities could allow the attacker to perform various attacks such as obtaining sensitive information, performing denial of service attacks, bypassing security restrictions, data manipulation (view, modify, add, delete), executing

Palo Alto has released security updates to fix multiple vulnerabilities across several Palo Alto products. The addressed vulnerabilities could allow the attacker to elevate privilege to root access, bypass security restrictions, execute untrusted software without being detected or blocked, and gain access to the affected product. Sample of the addressed vulnerabilities: 1. Palo Alto Expedition

Citrix has released security updates to address several vulnerabilities across multiple Citrix products. The addressed vulnerabilities could allow the attacker to perform denial of service attacks, gain privileges, obtain sensitive information, bypass security restrictions, or execute arbitrary code and gain access to the affected system by sending a specially crafted request. Sample of the addressed

Microsoft has released its monthly patch of security updates, known as Patch Tuesday. The mentioned patch addressed four zero-day vulnerabilities. Microsoft has fixed (142) vulnerabilities, with (4) classified as critical as they could allow the attacker to execute arbitrary code, this could result in remote code execution, gain access, and gain elevated privileges to the

Apache has released a security update to address several vulnerabilities across Apache HTTP Server 2.4.58 and earlier. The addressed vulnerabilities could allow the attacker to perform denial of service attacks, bypass security restrictions, obtain sensitive information, execute arbitrary code, and gain access to the affected system by sending a specially crafted request. Sample of the

OpenSSH released a security update to fix a vulnerability affecting all versions of OpenSSH between 8.5p1 and 9.7p1. The addressed vulnerability could allow the unauthenticated remote attacker to execute arbitrary code with root privileges and gain access to the affected system by sending specially crafted requests. OpenSSH Code Execution Vulnerability (CVE-2024-6387): CVSS: 9.8 Attack Vector:

Juniper has released security updates to fix a critical vulnerability that affects multiple Juniper products. The addressed vulnerability could allow the remote attacker to bypass security restrictions, bypass authentication, and take full control of the affected products by sending specially crafted requests. Juniper Networks Session Smart Router Security Bypass (CVE-2024-2973): CVSS: 10 Attack Vector: Network

Progress has released a security update to address several vulnerabilities affecting WhatsUp Gold 23.1.2 and all older versions. The addressed vulnerability could allow the remote attacker to bypass security restrictions, perform denial of services attacks, gain elevated privileges, obtain sensitive information, upload arbitrary files, or execute arbitrary code and gain access to the affected system.

Fortra has released a security update to address several vulnerabilities in multiple Fortra products. The addressed vulnerabilities could allow the attacker to gain elevated privileges, obtain sensitive information, bypass security restrictions, or manipulate data and gain access to the affected system. Sample of the addressed vulnerabilities: 1. Fortra FileCatalyst Workflow SQL Injection (CVE-2024-5276): CVSS: 9.8

MOVEit Transfer has released security updates to address a critical vulnerability across multiple versions of Progress MOVEit Transfer. The addressed vulnerability could allow the remote attacker to bypass authentication because of inadequate authentication measures. Progress MOVEit Transfer Authentication Bypass Vulnerability (CVE-2024-5806): CVSS: 9.1 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None

Trellix has released a security update to fix multiple vulnerabilities across Trellix Intrusion Prevention System. The addressed vulnerabilities could allow the remote attacker to obtain sensitive information or execute arbitrary code and gain access to the affected system. The addressed vulnerabilities: 1. Trellix Intrusion Prevention System Manager Code Execution Vulnerability (CVE-2024-5671): CVSS: 9.8 Attack Vector:

VMware has released a security update to address several vulnerabilities in multiple VMware products, including VMware vCenter Server and VMware Cloud Foundation. The addressed vulnerabilities could allow the attacker to gain elevated privileges, or execute arbitrary code and gain access to the affected system by sending a specially crafted packet. Sample of the addressed vulnerabilities:

Adobe has released security updates to fix multiple vulnerabilities across several Adobe products. The addressed vulnerabilities could allow the attacker to bypass security restrictions, escalate privilege, obtain sensitive information, trigger denial of services attacks, or execute arbitrary code and gain access to the affected products. Sample of the addressed vulnerabilities: 1. Adobe Commerce and Magento

Microsoft has released its monthly patch of security updates, known as Patch Tuesday. The mentioned patch addressed one zero-day vulnerability. Microsoft has fixed (51) vulnerabilities, with (1) classified as critical as they could allow the attacker to execute arbitrary code, remote code execution, and gain access to the affected products. June’s Patch Tuesday was released

Veeam has released a security update to fix a critical vulnerability across Veeam Recovery Orchestrator. The addressed vulnerability could allow the remote attacker to gain access to the VRO web UI with administrative privileges in the affected system. Veeam Recovery Orchestrator Gain Access Vulnerability (CVE-2024-29855): CVSS: 9 Attack Vector: Network Attack Complexity: High Privileges Required:

PHP has released security updates to fix several vulnerabilities across multiple PHP versions (8.1, 8.2, 8.3). The addressed vulnerabilities could allow the attacker to bypass security restrictions, execute arbitrary code, and gain access to the affected product by sending a specially crafted request. Sample of the addressed vulnerabilities: 1. PHP Code Execution Vulnerability (CVE-2024-4577): CVSS:

OpenSSL has released a security update to fix a critical vulnerability across multiple OpenSSL versions. The addressed vulnerability could allow the remote attacker to execute arbitrary code and gain access to the affected systems by sending a specially crafted request. OpenSSL Code Execution Vulnerability (CVE-2024-4741): CVSS: 9.8 Attack Vector: Network Attack Complexity: Low Privileges Required: