Improper Privilege Management in dotcms/core

Description Hello team, I found a SSTI that allow me to get Full Privilege Escalation system user 1. While editing a template we have total access to the User and UserModel classes via $user 2. One of the UserModel methods is called setUserId 3. If we call setUserId and pass "system" as parameter...

Matrix clients -- several vulnerabilities

Matrix developers report: Today we are releasing security updates to libolm, matrix-js-sdk, and several clients including Element Web / Desktop. Users are encouraged to upgrade as soon as possible. These releases mitigate a buffer overflow in olmsessiondescribe, a libolm debugging function used b...

Notice: CentOS6 applications and mitigation for CVEs

Problem A security bulletin is issued to users on several QRadar versions identifying CVEs related to CentOS6 base images used in QRadar applications. Administrators are advised per the security bulletin to upgrade applications to mitigate the security issue. Cause Applications that use a CentOS6...

Here’s what data the FBI can get from WhatsApp, iMessage, Signal, Telegram, and more

Not every secure messaging app is as safe as it would like us to think. And some are safer than others. A recently disclosed FBI training document shows how much access to the content of encrypted messages from secure messaging services US law enforcement can gain and what they can learn about yo...

CLSA-2021-1637770001 Fixed CVEs in vim: CVE-2021-3928, CVE-2021-3927

CVE-2021-3927: fix heap-based buffer overflow when reading character past end of line - CVE-2021-3928: fix stack-based buffer overflow when reading uninitialized memory when giving spell suggestions...

Dell EMC CloudLink CSV Formula Injection Vulnerability

Dell EMC CloudLink is a flexible data encryption and key management solution for data encryption in public, private, and hybrid cloud environments.A CSV formula injection vulnerability exists in Dell EMC CloudLink 7.1 and earlier versions, which can be exploited by remote, high-privilege attacker...

CVE-2021-31852

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

CVE-2021-36334

Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to arbitrary code execution on end user machine...

CVE-2021-36314

Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. A remote unauthenticated attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary files on the end user system...

CVE-2021-31852 Cross-Site Scripting vulnerability in Policy Auditor

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

November 22, 2021—KB5007253 (OS Builds 19041.1387, 19042.1387, 19043.1387, and 19044.1387) Preview

None None...

SmarterMail Remote Code Execution Vulnerability

SmarterMail is the award-winning email, collaboration and group chat server that easily meets the needs of businesses of any size, from individual business owners to large corporations and enterprise organizations. With lower hardware requirements, superior stability and lower maintenance costs,...

Hitachi Energy Relion 系列安全漏洞

Hitachi Energy Relion is a Swiss Hitachi Energy company used to protect, control, measure and monitor for power systems. A security vulnerability exists in the Hitachi Energy Relion Relion 670/650/SAM600-IO Series that allows an attacker to gain access to the front-end network port and cause a...

Vulnerabilities fixed in Drupal

Drupal developers have fixed two vulnerabilities in Drupal core. The vulnerabilities are in CKEditor, a library used by Drupal to provide the WYSIWYG editor. An unauthenticated malicious person can exploit the exploit the vulnerabilities to perform a Cross-Site Scripting XSS attack. Such an attac...

Adopting a Zero Trust approach throughout the lifecycle of data

Instead of believing everything behind the corporate firewall is safe, the Zero Trust model assumes breach and verifies each request as though it originates from an uncontrolled network. Regardless of where the request originates or what resource it accesses, Zero Trust teaches us to “never trust...

Adopting a Zero Trust approach throughout the lifecycle of data

Instead of believing everything behind the corporate firewall is safe, the Zero Trust model assumes breach and verifies each request as though it originates from an uncontrolled network. Regardless of where the request originates or what resource it accesses, Zero Trust teaches us to “never trust...

Smartertools SmarterTools SmarterMail 安全漏洞

SmarterMail is the award-winning email, collaboration and group chat server that easily meets the needs of businesses of any size, from individual business owners to large corporations and enterprise organizations. With lower hardware requirements, superior stability and lower maintenance costs,...

Vulnerabilities fixed in GNU Mailman

The developers of GNU Mailman have fixed two vulnerabilities fixed in GNU Mailman. The vulnerabilities could be exploited by a malicious person to gain access to the administrator password, or to use a cross-site scripting attack to execute code in the scope of the affected browser. To gain acces...

Keybase Information Disclosure Vulnerability

Keybase is a social networking platform based on PGP technology that supports end-to-end encryption.An information disclosure vulnerability exists in Keybase Client for Android before version 5.8.0 and Keybase Client for iOS before version 5.8.0, which stems from the client's inability to properl...

Keybase path traversal vulnerability

Keybase is a PGP technology-based social networking platform that supports end-to-end encryption.Keybase Client for Windows prior to version 5.7.0 is vulnerable to a path traversal vulnerability that stems from a networked system or product failing to properly filter special elements in a resourc...