229 matches found
CVE-2021-41831
The connected documents confirm a vulnerability in LibreOffice's handling of digital signatures in ODF documents (CVE-2021-25634). An Improper Certificate Validation flaw allowed an attacker to modify a digitally signed ODF document to insert an extra signing time timestamp, which LibreOffice cou...
GHSA-45H5-R968-5XR7 Exposure of sensitive information in Elasticsearch
A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...
UBUNTU-CVE-2021-22147
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...
How to spot a DocuSign phish and what to do about it
Phishing scammers love well known brand names, because people trust them, and their email designs are easy to rip off. And the brands phishers like most are the ones youre expecting to hear from, or wouldnt be surprised to hear from, like Amazon or DHL. Now you can add DocuSign to that list...
Elastic Stack 7.14.0 Security Update
Elasticsearch Document/Field Level Security issue ESA-2021-18 A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view. Affected...
MGASA-2021-0332 Updated htmldoc packages fix security vulnerabilities
Updated htmldoc packages fix security vulnerabilities: Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is similar to CVE-2017-9181 CVE-2021-20308. AddressSanitizer: double-free in function pspdfexport ps-pdf.cxx...
PT-2021-14865 · Elastic · Elasticsearch
Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.11.2 Elasticsearch versions prior to 6.8.15 Description: A document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when...
Command Execution Vulnerability in Isthmus Electronic Document Security Management System
Electronic document security management system referred to as: CDG is an electronic document security protection software, the system utilizes the driver layer transparent encryption technology, through the encryption and protection of electronic documents, to prevent the internal staff leakage a...
UBUNTU-CVE-2021-22134
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been...
PT-2021-11346 · Softmaker · Softmaker Office Planmaker
Name of the Vulnerable Software and Affected Versions: SoftMaker Office PlanMaker version 2021 Revision 1014 Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size...
PT-2021-11345 · Softmaker · Softmaker Office Planmaker 2021
Name of the Vulnerable Software and Affected Versions: SoftMaker Office PlanMaker 2021 Revision 1014 Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used fo...
Vulnerability fixed in ElasticSearch
A vulnerability has been fixed in ElasticSearch. The vulnerability allows a malicious person to obtain system data. This is only possible if Document or Field Level security is used. Elastic classifies this vulnerability with a CvSS score of 3.1. Elastic has released updates to fix the...
Open-Xchange: XSS on opening a malicious OpenOffice text document
Title Opening a malicious OpenOffice text document may lead to cross site scripting XSS attacks Description When generating HTML content for a comment present in text file, a placeholder div is generated by CommentPlaceHolder.java. The attribute data-container-id of this div is directly construct...
elasticsearch: Improper permission issue when attaching a new name to an index
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the aliases, shrink, or split endpoints are used . If the elasticsearch.yml file has xpack.security.dlsfls.enabled set to false, certain permission...
wewigs.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1112092 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting wewigs.com website and its...
Building on secure productivity
Among the most common and powerful attack vectors we have seen are those that exploit the daily tradeoff users make between security and productivity. Often, this can be as simple as a document hiding an exploit or a malicious link. As an industry, we’re used to thinking of security and...
CVE-2019-9853
LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in...
CVE-2016-6353
CVE-2016-6353 affects Cloudera CDH’s Cloudera Search component. The vulnerability arises in Solr Queries by document ID that can bypass Sentry document-level security via the RealTimeGetHandler, permitting unauthorized access to documents. Affected software is Cloudera CDH with Cloudera Search (p...
Debian DLA-1947-1 : libreoffice security update
Several vulnerabilities were discovered in LibreOffice, the office productivity suite. CVE-2019-9848 Nils Emmerich discovered that malicious documents could execute arbitrary Python code via LibreLogo. CVE-2019-9849 Matei Badanoiu discovered that the stealth mode did not apply to bullet graphics...