Atlassian has released patches for two remote code execution (RCE) vulnerabilities in Confluence Data Center and Server and another in Bamboo Data Center. The most severe of these issues, tracked as CVE-2023-22508 (CVSS score of 8.5), was introduced in Confluence version 7.4.0. The second bug, tracked as CVE-2023-22505 (CVSS score of 8.0), was introduced in ..
Tag : Vulnerabilities
Network security company Perimeter81 apparently needs to improve its responsible disclosure process for vulnerabilities found in its products. Cybersecurity researcher Erhad Husovic published a blog post in late June to disclose the details of a local privilege escalation vulnerability discovered in Perimeter81’s macOS application. The researcher said the privilege escalation exploit leverages a misconfigured XPC ..
Three vulnerabilities in Apache OpenMeetings potentially expose organizations to remote code execution attacks, cybersecurity firm Sonar warns. A web conferencing application, OpenMeetings is used for online meetings, collaboration, and presentations, either as standalone software or as a plugin for Confluence, Jira, and other applications. On Thursday, Sonar published information on three OpenMeetings bugs – CVE-2023-28936, ..
reader comments 39 with Two years ago, ransomware crooks breached hardware-maker Gigabyte and dumped more than 112 gigabytes of data that included information from some of its most important supply-chain partners, including Intel and AMD. Now researchers are warning that the leaked information revealed what could amount to critical zero-day vulnerabilities that could imperil huge ..
Firmware and hardware security company Eclypsium has disclosed information on two new vulnerabilities found by its researchers in the American Megatrends (AMI) MegaRAC Baseboard Management Controller (BMC) software. Eclypsium disclosed other flaws discovered as part of the same research project in December 2022. The analysis focused on information leaked as a result of a ransomware ..
Adobe has released a second round of patches for some recently disclosed ColdFusion vulnerabilities, including flaws that appear to have been exploited in attacks. On July 11, Adobe announced patches for CVE-2023-29298, an improper access control issue that can lead to a security feature bypass. On July 14, the company informed customers about fixes for ..
Oracle on Tuesday announced the release of 508 new security patches as part of the July 2023 CPU, including more than 75 patches that resolve critical-severity vulnerabilities. More than 350 of the security patches address vulnerabilities that can be exploited remotely, without authentication. Some of these flaws impact multiple products, Oracle’s advisory reveals. As part ..
Citrix on Tuesday announced patches for three vulnerabilities, including an actively exploited zero-day that allows remote code execution. The zero-day, tracked as CVE-2023-3519 and rated ‘critical’, affects Citrix ADC and Gateway products. It can be exploited remotely without authentication, but only against appliances that are configured as a gateway or AAA virtual server. Citrix warned ..
Google on Tuesday announced the release of Chrome 115 to the stable channel, with patches for 20 vulnerabilities, including 11 reported by external researchers. Of the externally reported security defects, four are assessed with a ‘high severity’ rating. Based on the bug bounties paid for them, the most important of these are CVE-2023-3727 and CVE-2023-3728, ..
At least two recently disclosed Adobe ColdFusion vulnerabilities appear to have been exploited in the wild, including a flaw that security experts say has not been completely patched by the software giant. Last week, Adobe informed customers about three critical ColdFusion vulnerabilities. First, on July 11, it announced patches for CVE-2023-29298, an improper access control ..
