229 matches found
Design/Logic Flaw
LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in...
CVE-2019-9853
LibreOffice: CVE-2019-9853 — A URL decoding flaw in how macro URLs are processed and categorized lets an attacker craft a document that bypasses macro security settings, enabling arbitrary macro execution. Affected versions: LibreOffice 6.2 before 6.2.7 and 6.3 before 6.3.1. Remediation: update t...
CVE-2019-9852 Insufficient URL encoding flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...
Arbitrary File Download Vulnerability in Isthmus Electronic Document Security Management System (CNVD-2019-27482)
Electronic document security management system abbreviation: CDG is an electronic document security protection software. An arbitrary file read vulnerability exists in the IZP Electronic Document Security Management System. The download function somewhere in Yisetong Electronic Document Security...
Weak Password Vulnerability in Isthmus Electronic Document Security Management System
Electronic document security management system abbreviation: CDG is an electronic document security protection software. Document security management system there is a default password; attackers can log in through the default password to obtain sensitive information after the management of the...
First American Financial Corp. Data Records Leak
Krebs on Security is reporting a massive data leak by the real estate title insurance company First American Financial Corp. "The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and eve...
First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records
The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. NYSE:FAF leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records -- including bank account numbers and...
Slack Bug Allows Remote File Hijacking, Malware Injection
A remotely exploitable vulnerability in the Windows desktop app version of the Slack collaboration platform has been uncovered, which allows attackers to alter where files from Slack are downloaded. Nefarious types could redirect the files to their own SMB server; and, they could manipulate the...
Unauthorized Access Vulnerability in the SESSION Page of E-Document Security Management System (E-DSMS)
Yisetong electronic document security management system abbreviation: CDG is an electronic document security protection software. An unauthorized access vulnerability exists in the SESSION page of Yisetong Electronic Document Security Management System. An attacker can exploit this vulnerability ...
CVE-2018-16858
CVE-2018-16858 : LibreOffice before 6.0.7 and 6.1.3 is affected by a directory traversal vulnerability that allows executing arbitrary macros bundled with a document. An attacker could craft a document that, when opened, runs a Python method from a script located anywhere on the file system relat...
CVE-2018-16858
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script i...
CVE-2016-9601
CVE-2016-9601 : Ghostscript before version 9.21 is vulnerable to a heap-based buffer overflow in the jbig2_decode_gray_scale_image function used for JBIG2 halftone decoding, potentially causing a segmentation fault when parsing a crafted PostScript/PDF with an embedded JBIG2 image, per multiple c...
[SECURITY] Fedora 25 Update: mupdf-1.11-9.fc25
MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...
The latest exposure of the RTF vulnerability beside the use of research to explore the topic guide-vulnerability warning-the black bar safety net
0×1 details In recent days, Tencent computer housekeeper to capture a new office document virus samples, 经阐发为9月12号刚被微软修复的.NET Framework vulnerability flaws bug（CVE-2017-8759 the fields of intrusion samples. The vulnerability flaws of the bug with the previous rtf vulnerabilities flaws...
Design/Logic Flaw
An exploitable use-after-free exists in the PDF parsing functionality of Lexmark Perspective Document Filters 11.3.0.2400 and 11.4.0.2452. A crafted PDF document can lead to a use-after-free resulting in direct code execution...
CVE-2017-8450
X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...
Information disclosure
X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users without access to a document and/or field may have been able to access this information...
Generalized s2-045 Remote Code Execution Vulnerability in Frontier Windray Electronic Document Security Management System
Frontier Fenglei electronic document security management system is the use of encryption algorithms for important electronic documents for a variety of different levels of encryption protection, and according to the document protection policy for specific user groups to give access to a variety o...
Huawei Document Security Management Information Disclosure Vulnerability
Huawei Document Security Management DSM is a set of document rights management software from Huawei, China. The software is characterized by high stability, reliability and scalability. A security vulnerability exists in the privilege control function in Huawei DSM versions prior to...