Splunk recently addressed Vulnerability-related.PatchVulnerability several vulnerabilities in Enterprise and Light products , some of them have been rated “ high severity. ” Splunk Enterprise solution allows organizations to aggregate , search , analyze , and visualize data from various sources that are critical to business operations . The Splunk Light is a comprehensive solution for small IT environments that automates log analysis and integrate server and network monitoring . “ To mitigate these issues , Splunk recommends upgrading Vulnerability-related.PatchVulnerability to the latest release and applying Vulnerability-related.PatchVulnerability as many of the Hardening Standards from the Securing Splunk documentation as are relevant to your environment . Splunk Enterprise and Splunk Light releases are cumulative , meaning that future releases will contain fixes to these vulnerabilities , new features and other bug fixes , ” reads the advisory published Vulnerability-related.PatchVulnerability by Splunk . The most severe issue fixed Vulnerability-related.PatchVulnerability by the company is a high severity cross-site scripting ( XSS ) flaw in the Web interface , tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7427 , that received the CVSS score of 8.1 . Another severe vulnerability is a DoS flaw tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7432 that could be exploited Vulnerability-related.DiscoverVulnerability using malicious HTTP requests sent to Splunkd that is the system process that handles indexing , searching and forwarding . This issue was tracked as Vulnerability-related.DiscoverVulnerability “ medium severity ” by the company . The company also addressed Vulnerability-related.PatchVulnerability a denial-of-service ( DoS ) vulnerability , tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7429 , that could be exploited Vulnerability-related.DiscoverVulnerability by an attacker by sending a specially crafted HTTP request to Splunkd . The last flaw addressed Vulnerability-related.PatchVulnerability by the vendor , tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7431 , is a path traversal issue that allows an authenticated attacker to download arbitrary files from the vendor Django app . The vulnerability has been rated Vulnerability-related.DiscoverVulnerability “ medium severity. ” The vendor declared it has found Vulnerability-related.DiscoverVulnerability no evidence that these vulnerabilities have been exploited Vulnerability-related.DiscoverVulnerability in attacks in the wild .

Oracle released Vulnerability-related.PatchVulnerability its latest Critical Patch Update on July 18 , fixing Vulnerability-related.PatchVulnerability 334 vulnerabilities across the company 's product portfolio . The company rated 61 of the vulnerabilities as having critical impact . Among the products patched Vulnerability-related.PatchVulnerability by Oracle are Oracle Database Server , Oracle Global Lifecycle Management , Oracle Fusion Middleware , Oracle E-Business Suite , Oracle PeopleSoft , Oracle Siebel CRM , Oracle Industry Applications , Oracle Java SE , Oracle Virtualization , Oracle MySQL and Oracle Sun Systems Products Suite . While there are issues of varying severity in the update , Oracle is blaming third-party components as being the cause of the majority of the critical issues . `` It is fair to note that bugs in third-party components make up a disproportionate amount of severe vulnerabilities in this Critical Patch Update , '' Eric Maurice , director of security assurance at Oracle , wrote in a blog post . `` 90 percent of the critical vulnerabilities addressed Vulnerability-related.PatchVulnerability in this Critical Patch Update are for non-Oracle CVEs . '' Of the 334 issues fixed Vulnerability-related.PatchVulnerability in the July Critical Patch Update , 37 percent were for third-party components included in Oracle product distributions . While many flaws were from third-party libraries , there were also flaws in Oracle 's own development efforts . Oracle 's namesake database was patched Vulnerability-related.PatchVulnerability for three issues , one of which is remotely exploitable without user authentication . Oracle 's Financial Services application received Vulnerability-related.PatchVulnerability the highest total number of patches at 56 , with 21 identified as being remotely exploitable without user authentication . Oracle 's Fusion Middleware , on the other hand , got Vulnerability-related.PatchVulnerability 44 new security fixes , with 38 of them rated as being critical . Oracle Enterprise Manager Products were patched Vulnerability-related.PatchVulnerability for 16 issues , all of which are remotely exploitable without authentication . Looking at flaws in Java , Oracle 's July CPU provides Vulnerability-related.PatchVulnerability eight security fixes , though organizations likely need to be cautious when applying Vulnerability-related.PatchVulnerability the patches , as certain functionality has been removed . `` Several actions taken to fix Vulnerability-related.PatchVulnerability Java SE vulnerabilities in the July CPU are likely to break the functionality of certain applications , '' security firm Waratek warned in an advisory . `` Application owners who apply Vulnerability-related.PatchVulnerability binary patches should be extremely cautious and thoroughly test their applications before putting Vulnerability-related.PatchVulnerability patches into production . '' The reason why the Oracle fixes could break application functionality is because Oracle has decided to remove multiple vulnerable components from its Java Development Kit ( JDK ) . At 334 fixed flaws , the July update is larger than last Critical Patch Update released Vulnerability-related.PatchVulnerability on Jan 15 , which provided Vulnerability-related.PatchVulnerability patches for 237 flaws . While the number of patches issues has grown , Matias Mevied , Oracle security researcher at Onapsis , commented that Oracle is working in the right way , fixing Vulnerability-related.PatchVulnerability the reported vulnerabilities and is getting faster every year . `` Unfortunately , based in our experience , the missing part is that the companies still do n't implement the patches as soon as they should be , '' Mevied told eWEEK .