Splunk recently addressed Vulnerability-related.PatchVulnerability several vulnerabilities in Enterprise and Light products , some of them have been rated “ high severity. ” Splunk Enterprise solution allows organizations to aggregate , search , analyze , and visualize data from various sources that are critical to business operations . The Splunk Light is a comprehensive solution for small IT environments that automates log analysis and integrate server and network monitoring . “ To mitigate these issues , Splunk recommends upgrading Vulnerability-related.PatchVulnerability to the latest release and applying Vulnerability-related.PatchVulnerability as many of the Hardening Standards from the Securing Splunk documentation as are relevant to your environment . Splunk Enterprise and Splunk Light releases are cumulative , meaning that future releases will contain fixes to these vulnerabilities , new features and other bug fixes , ” reads the advisory published Vulnerability-related.PatchVulnerability by Splunk . The most severe issue fixed Vulnerability-related.PatchVulnerability by the company is a high severity cross-site scripting ( XSS ) flaw in the Web interface , tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7427 , that received the CVSS score of 8.1 . Another severe vulnerability is a DoS flaw tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7432 that could be exploited Vulnerability-related.DiscoverVulnerability using malicious HTTP requests sent to Splunkd that is the system process that handles indexing , searching and forwarding . This issue was tracked as Vulnerability-related.DiscoverVulnerability “ medium severity ” by the company . The company also addressed Vulnerability-related.PatchVulnerability a denial-of-service ( DoS ) vulnerability , tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7429 , that could be exploited Vulnerability-related.DiscoverVulnerability by an attacker by sending a specially crafted HTTP request to Splunkd . The last flaw addressed Vulnerability-related.PatchVulnerability by the vendor , tracked as Vulnerability-related.DiscoverVulnerability CVE-2018-7431 , is a path traversal issue that allows an authenticated attacker to download arbitrary files from the vendor Django app . The vulnerability has been rated Vulnerability-related.DiscoverVulnerability “ medium severity. ” The vendor declared it has found Vulnerability-related.DiscoverVulnerability no evidence that these vulnerabilities have been exploited Vulnerability-related.DiscoverVulnerability in attacks in the wild .

The Git community has disclosed Vulnerability-related.DiscoverVulnerability a security vulnerability affecting Vulnerability-related.DiscoverVulnerability the clone and submodule commands that could enable remote code execution when vulnerable machines access malicious repositories . The vulnerability , which has been assigned Vulnerability-related.DiscoverVulnerability CVE–2018–17456 by Mitre , has been fixed Vulnerability-related.PatchVulnerability in Git 2.19.1 . To trigger the vulnerability , a malicious repository could forge a .gitmodules containing an URL starting with a dash . This would affect Vulnerability-related.DiscoverVulnerability both git clone -- recurse-submodules and git submodule update -- recursive in that they would recursively pass the URL starting with a dash to a git clone or git submodule subprocess that would interpret the URL as a command option . This could lead to executing an arbitrary command on the local machine . This vulnerability is similar to CVE–2017–1000117 , which also enabled an option-injection attack by forging ssh URLs starting with a dash that would be interpreted as an option by the ssh subprocess executed by git . No exploits are known at the moment . We were also able to use the time to scan all repositories on GitHub for evidence of the attack being used in the wild . As shown in the PR fixing Vulnerability-related.PatchVulnerability the vulnerability , submitted by @ joernchen , the fix is quite trivial in itself . Yet , this discovery provided the opportunity for an overall audit of .gitmodules , which led to implementing stricter checks on both paths and URLs found inside of it . As mentioned , the fix for this vulnerability is included in Git 2.19.1 . Additionally , it has been backported Vulnerability-related.PatchVulnerability to versions 2.14.5 , 2.15.3 , 2.16.5 , 2.17.2 , and 2.18.1 . Since git is integrated in GitHub projects such as GitHub Desktop and Atom , those have been patched Vulnerability-related.PatchVulnerability as well , so you will be better off upgrading Vulnerability-related.PatchVulnerability them as soon as possible .

Juniper Networks has released Vulnerability-related.PatchVulnerability its first cluster of security updates for 2019 , with the patches addressing Vulnerability-related.PatchVulnerability vulnerabilities in various products developed by the US networking equipment firm . Among the 19 security advisories released on Wednesday is a critical bug impacting Vulnerability-related.DiscoverVulnerability Junos OS , the FreeBSD-based operating system used in Juniper ’ s routers . CVE-2019-0006 affects Vulnerability-related.DiscoverVulnerability Junos OS versions 14.1X53 , 15.1 , 15.1X53 , where it was found Vulnerability-related.DiscoverVulnerability that a specially crafted HTTP packet could crash the fxpc daemon or could potentially lead to remote code execution ( RCE ) . Also marked as critical is CVE-2019-0007 , which addresses Vulnerability-related.PatchVulnerability a vulnerability in vMX series virtual routers running Junos OS 15.1 . “ The vMX series software uses a predictable IP ID Sequence Number , ” said Juniper . “ This leaves the system as well as clients connecting through the device susceptible to a family of attacks. ” Patches have also been released Vulnerability-related.PatchVulnerability for eight vulnerabilities in the libxml2 software library that impact Vulnerability-related.DiscoverVulnerability Junos OS . Eight additional security updates have been released Vulnerability-related.PatchVulnerability by Juniper that feature mitigations for high-level impact bugs , while a further six deal with less severe flaws . Multiple vulnerabilities were also discovered Vulnerability-related.DiscoverVulnerability in Juniper ’ s Advanced Threat Prevention ( ATP ) cloud security service . And finally , Juniper said nearly 40 vulnerabilities have been resolved Vulnerability-related.PatchVulnerability in the Junos Space Network Management Platform 18.3R1 and 18.4R1 by upgrading Vulnerability-related.PatchVulnerability third party components or fixing Vulnerability-related.PatchVulnerability internally discovered security vulnerabilities . Commenting on the advisories , the National Cybersecurity and Communications Integration Center ( NCCIC ) , said : “ Users and administrators should review Juniper ’ s Security Advisories webpage and apply the necessary updates . ”