風險: 中度風險
類型: 伺服器 - 互聯網應用伺服器
於 IBM WebSphere 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、洩露敏感資料及繞過保安限制。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Servers - Internet App Servers
Multiple vulnerabilities were identified in IBM WebSphere Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and security restriction bypass on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、資料洩露、繞過保安限制及遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, information disclosure, security restriction bypass and remote code execution on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 極高度風險
類型: 伺服器 - 數據庫伺服器
於甲骨文產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料、資料篡改、跨網站指令碼及繞過保安限制。
注意： CVE-2023-41993 已被積極利用，讓未經認證的攻擊者透過多種通訊協定存取網絡，入侵 Oracle Java SE、Oracle GraalVM 企業版。 成功的攻擊需要攻擊者以外的人進行人為互動。 成功攻擊此漏洞可導致接管 Oracle Java SE、Oracle GraalVM 企業版。
有關其他 甲骨文 產品，請參閱以下連結:
https://www.oracle.com/security-alerts/cpuapr2024.html
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
https://www.oracle.com/security-alerts/cpuapr2024.html
RISK: Extremely High Risk
TYPE: Servers - Database Servers
Multiple vulnerabilities were identified in Oracle Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure, data manipulation, cross-site scripting and security restriction bypass on the targeted system.
Note: CVE-2023-41993 have been actively exploited, allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM Enterprise Edition.
For other Oracle products, please refer to the link below:
https://www.oracle.com/security-alerts/cpuapr2024.html
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
https://www.oracle.com/security-alerts/cpuapr2024.html
風險: 中度風險
類型: 操作系統 - LINUX
於 Debian Linux 內核發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升及洩露敏感資料。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Operating Systems - Linux
Multiple vulnerabilities were identified in Debian Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and sensitive information disclosure on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
RISK: Medium Risk
TYPE: Operating Systems - VM Ware
A vulnerability was identified in Xen. A remote attacker could exploit this vulnerability to trigger denial of service on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 伺服器 - 其他伺服器
於 GitLab 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發跨網站指令碼及阻斷服務。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式：
RISK: Medium Risk
TYPE: Servers - Other Servers
Multiple vulnerabilities were identified in GitLab. A remote attacker could exploit some of these vulnerabilities to trigger cross-site scripting and denial of service on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 極高度風險
類型: 保安軟件及應用設備 - 保安軟件及應用設備
在 Palo Alto 產品發現一個漏洞。遠端攻擊者可利用此漏洞，於目標系統觸發遠端執行程式碼。
注意: CVE-2024-3400 影響 Palo Alto Networks PAN-OS 軟件中的 GlobalProtect 功能，在特定的PAN-OS 版本和不同的功能配置下，可能會讓未經認證的攻擊者以root 權限在防火牆上觸發遠端執行程式碼。
[更新於 2024-04-15 11:56]
更新解決方案， Palo Alto Networks 已發佈緊急更新。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
RISK: Extremely High Risk
TYPE: Security software and application - Security Software & Appliance
A vulnerability has been identified in Palo Alto Products. A remote attacker can exploit this vulnerability to trigger remote code execution on the targeted system.
Note: CVE-2024-3400 affected GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.
[Updated on 2024-04-15 11:56]
Updated solutions as Palo Alto Networks has released hotfix.
Before installation of the software, please visit the vendor web-site for more details.
風險: 中度風險
類型: 操作系統 - Network
於 Juniper Junos OS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、洩露敏感資料及繞過保安限制。
詳情請參閱以下連結﹕
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
請參閱 2024-04 安全公告。
RISK: Medium Risk
TYPE: Operating Systems - Networks OS
Multiple vulnerabilities were identified in Juniper Junos OS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and security restriction bypass on the targeted system.
Please refer to the link below for detail:
Before installation of the software, please visit the vendor web-site for more details.
Please refer to 2024-04 Security Bulletin.
