Open-Xchange Security Advisory 2014-01-06

Open-Xchange Security Advisory 2014-01-06 Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 30203 Bug ID Vulnerability type: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page Vulnerable version: 7.4.0 and earlier Vulnerable component: backend Fixe...

Threat Outbreak Alert: Fake Financial Documents Email Messages on December 20, 2013

Medium Alert ID: 32251 First Published: 2013 December 23 14:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain financial documents for the recipient. The text in the email message attempts to convince the recipient to op...

Threat Outbreak Alert: Fake Invoice Documents Attachment Email Messages on December 18, 2013

Medium Alert ID: 32216 First Published: 2013 December 18 17:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain invoice documents for the recipient. The text in the email message attempts to convince the...

NSA Officials Say Snowden Used Legitimate Access to Steal Data

It’s taken more than six months, but top officials at the National Security Agency are finally discussing some of the details of how former agency contractor Edward Snowden got access to all of the documents he stole and what kind of damage they believe the publication of the information they...

qt4-xml -- XML Entity Expansion Denial of Service

Richard J. Moore reports: QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted data then the application...

Threat Outbreak Alert: Fake Bank Documents Email Messages on November 27, 2013

Medium Alert ID: 31931 First Published: 2013 December 2 20:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank documents for the recipient. The text in the email message attempts to convince the recipient to open the...

CVE-2013-6622

Removed by vendor...

Microsoft Office Remote Code Execution Vulnerabilities (2885093)

This host is missing an important security update according to Microsoft Bulletin MS13-091. OpenVAS Vulnerability Test $Id: secpodms13-091.nasl 6079 2017-05-08 09:03:33Z teissa $ Microsoft Office Remote Code Execution Vulnerabilities 2885093 Authors: Antu Sanadi Copyright: Copyright c 2013 SecPod...

CVE-2013-3906: a graphics vulnerability exploited through Word documents

Recently we become aware of a vulnerability of a Microsoft graphics component that is actively exploited in targeted attacks using crafted Word documents sent by email. Today we are releasing Security Advisory 2896666 which includes a proactive Fix it workaround for blocking this attack while we...

CVE-2013-3906

creationtimestamp| type| source ---|---|--- 2013-11-05 07:00:00+00:00| seen| https://msrc.microsoft.com/blog/2013/11/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents/ 2013-11-08 08:57:29+00:00| seen| MISP/527ca75e-353c-4c91-a7d5-407a950d2109 2013-11-08 09:23:16+00:00| seen|...

NIST Reviews Crypto Standards Development

The National Institute for Standards and Technology has taken an important step toward repairing what the National Security Agency has allegedly fractured by initiating a review of its cryptographic standards development processes. NIST-sponsored algorithms are at the heart of numerous crypto...

CVE-2013-5596

The cycle collection CC implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial ...

Stack overflow

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote...

CVE-2013-5604

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote...

DSA-2779-1 libxml2 - denial of service

Bulletin has no description...

Microsoft Office Remote Code Execution Vulnerabilities (2885080)

This host is missing an important security update according to Microsoft Bulletin MS13-085. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Latest Snowden Leak Explains NSA Subversion of Tor Users

The latest Snowden documents, made public today, suggest the National Security Agency is able to peel back the veil on a small fraction of Tor users at a time, but overall the integrity of the anonymity network remains intact. Tor promises its users a level of anonymity online for their Web...

CVE-2013-4829

HP LaserJet M4555, M525, and M725; LaserJet flow MFP M525c; LaserJet Enterprise color flow MFP M575c; Color LaserJet CM4540, M575, and M775; and ScanJet Enterprise 8500fn1 FutureSmart devices allow local users to read images of arbitrary scanned documents via unspecified vectors...

Code injection

HP LaserJet M4555, M525, and M725; LaserJet flow MFP M525c; LaserJet Enterprise color flow MFP M575c; Color LaserJet CM4540, M575, and M775; and ScanJet Enterprise 8500fn1 FutureSmart devices allow local users to read images of arbitrary scanned documents via unspecified vectors...

CVE-2013-4829

HP LaserJet M4555, M525, and M725; LaserJet flow MFP M525c; LaserJet Enterprise color flow MFP M575c; Color LaserJet CM4540, M575, and M775; and ScanJet Enterprise 8500fn1 FutureSmart devices allow local users to read images of arbitrary scanned documents via unspecified vectors...