Security Notices
ManageEngine Applications Manager Updates Address Six Vulnerabilities
ManageEngine Applications Manager fixes span Enterprise synchronization, plugin identity, monitor scope and an installer-exposed cloud key. Match the supported build track and review unauthorized changes; updating does not establish that the old cloud key was revoked.
WatchGuard AuthPoint 7.5.1 Fixes LDAP Authentication Bypass
AuthPoint Authentication Gateway 7.5.1 fixes an LDAP Sync first-factor bypass under non-default conditions. Update affected gateways while preserving additional factors; WatchGuard explicitly says those factors still apply, so this is not a complete MFA bypass.
Apache Tomcat Native Updates Address Three TLS Flaws
Tomcat Native updates fix handshake crashes, insecure TLS defaults and a client-certificate race. Verify the native library loaded by each JVM; updating Tomcat Java files or system OpenSSL alone does not establish remediation.
Global IT Weoll Update Fixes SSRF Token Disclosure
Weoll releases before 3.2.45.44 have an SSRF issue identified with JWT disclosure. Apply the supported update and review outbound requests, while retaining the public evidence limit: the exact endpoint and token flow are undocumented.
Abis Technology AVESIS Update Fixes Open Redirect
Affected AVESIS builds can redirect users to untrusted destinations without an attacker account. Confirm the deployed build and supported correction with the service owner; an open redirect alone does not establish account takeover or code execution.
Forcepoint Security Engine Updates Fix Policy Bypass
Forcepoint Security Engine has a policy-bypass flaw with non-contiguous affected versions and a vendor-reported exploitation signal. Match the exact branch, obtain the supported fix, and avoid inventing packet-level workarounds from the sparse public description.
ManageEngine ITOM Updates Address Eleven Vulnerabilities
ManageEngine ITOM fixes span editions, plugins, roles and disjoint release intervals. Inventory Central/Probe and Firewall Analyzer exposure, follow each applicable upgrade matrix, and review unauthorized changes rather than assuming a higher build resolves every issue.
Apache Tomcat Updates Address Twelve Security Flaws
Tomcat updates address certificate checks, shared authentication, WebSocket controls and HTTP/AJP resource handling. Update the matching supported branch, including embedded runtimes through their vendor, and migrate unsupported releases rather than assuming their final builds are fixed.
Apache Sling Security Bundle Updates Address Two Filter Bypasses
Apache Sling Security Bundle fixes RefererFilter and ContentDispositionFilter bypasses at different version floors. Choose a supported release containing both fixes and verify the active bundle; stopping at 1.3.2 leaves the later issue unresolved.