Piotr Madej

The issue is related to an Improper Certificate Validation vulnerability in the client components of Dell EMC NetWorker, which uses SSL encrypted connections to communicate with the application server. An unauthenticated attacker in the same network collision domain as the client could potentially exploit this vulnerability to perform man-in-the-middle attacks, intercepting and tampering with the traffic between the client and the application server.

توجد مشكلة في خدمة Windows Print Spooler تتعلق بالإدارة غير الآمنة للصلاحيات. تسمح هذه الثغرة للمهاجمين عن بُعد بتنفيذ رمز عشوائي، وتصعيد الصلاحيات، والتأثير على النظام.

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c Description: The issue is related to insufficient input validation in the SQL Developer Install component of Oracle Database Server. This vulnerability can be easily exploited by a low-privileged attacker with Client Computer User Account privilege and logon to the infrastructure where SQL Developer Install executes. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized read access to a subset of SQL Developer Install accessible data. Recommendations: For versions 11.2.0.4, 12.1.0.2, 12.2.0.1, and 18c, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Edge (affected versions not specified) Description: A remote code execution issue exists due to improper access of objects in memory. This could allow an attacker to execute arbitrary code in the context of the current user, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited through a specially crafted website, and an attacker could convince a user to view the website, possibly through email or instant messaging enticement. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability allows authenticated remote users to expose technical information through error messages. This issue affects products including Hitachi Device Manager and Hitachi Compute Systems Manager.

A vulnerability allows authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. This issue affects various components of Hitachi Command Suite, including Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager, and Hitachi Compute Systems Manager.

A vulnerability allows an unauthenticated remote user to read internal information.

An Information Exposure issue was discovered, allowing a remote attacker to potentially exploit a flaw in the permission of messaging. This could enable information exposure via a crafted message.

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 9 through 11 Description: A remote code execution issue exists due to improper memory object access. This could lead to memory corruption, allowing an attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could gain control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. Recommendations: For Internet Explorer 9, update to a version that includes the fix for this issue. For Internet Explorer 10, update to a version that includes the fix for this issue. For Internet Explorer 11, update to a version that includes the fix for this issue.