CVE-2020-13958

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the documen...

UBUNTU-CVE-2020-26951

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability...

CVE-2020-26951

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the ISC² Security Congress 2020, November 16, 2020. I’ll be on a panel at the OECD Global Blockchain Policy Forum 2020 on November 17, 2020. The panel is called "Deep Dive: Digital Security and Distributed Ledger...

CVE-2019-8387

creationtimestamp| type| source ---|---|--- 2020-11-13 23:00:05+00:00| seen| MISP/618f66f3-43f7-4171-a1e8-23c823e87694 2020-11-13 23:01:06+00:00| seen| MISP/48155bf7-590f-4f27-bbd3-a50b89a146e5 2020-11-13 23:02:05+00:00| seen| MISP/8fe1b256-caca-4680-88bb-d90868dc4d21 2020-11-13 23:03:06+00:00|...

Apache OpenOffice < 4.1.8 Arbitrary Code Execution

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.8. It is, therefore, affected by an arbitrary code execution vulnerability in its scripting events component. An unauthenticated, remote attacker can exploit this, by convincing a user to download and open a...

CVE-2020-28415

creationtimestamp| type| source ---|---|--- 2020-11-12 22:32:13+00:00| seen| https://t.me/cibsecurity/16266 2020-11-12 22:32:15+00:00| seen| https://t.me/cibsecurity/16268...

CVE-2020-28414

creationtimestamp| type| source ---|---|--- 2020-11-12 22:32:13+00:00| seen| https://t.me/cibsecurity/16266 2020-11-12 22:32:15+00:00| seen| https://t.me/cibsecurity/16268...

FreeBSD : Apache OpenOffice -- Unrestricted actions leads to arbitrary code execution in crafted documents (4f15ca7b-23ae-11eb-9f59-1c1b0d9ea7e6)

The Apache Openofffice project reports : CVE-2020-13958 Unrestricted actions leads to arbitrary code execution in crafted documentsDescription A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the...

CVE-2020-17005

creationtimestamp| type| source ---|---|--- 2020-11-11 12:35:06+00:00| seen| https://t.me/cibsecurity/16151 2020-11-11 12:35:14+00:00| seen| https://t.me/cibsecurity/16159...

Low: Red Hat Security Advisory: resource-agents security and bug fix update

An update for resource-agents is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Netflix Dispatch Access Control Error Vulnerability

Netflix Dispatch is a US-based Netflix software that provides security event management with deep integration with Slack, GSuite, Jira and other tools. Netflix Dispatch suffers from an Access Control Error vulnerability that can be exploited by an attacker to view restricted events, escalate a...

Password choice

Introduction We’ve been advocates of regular password auditing for years. Over that time, we’ve noticed that password choice is not only very personal, but hugely influenced by current events, trends, and even what’s sat on your desk. Its given us a unique opportunity to see these common influenc...

kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a DoS

A flaw was found in the way the predicateparse function in the tracing subsystem of the Linux kernel handled resource cleanup on error. This flaw allows an attacker with the ability to produce the error to crash the system...

systemd: memory leak in button_open() in login/logind-button.c when udev events are received

A memory leak was discovered in the systemd-login when a power-switch event is received. A physical attacker may trigger one of these events and leak bytes due to a missing free...

kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a DoS

A flaw was found in the way the predicateparse function in the tracing subsystem of the Linux kernel handled resource cleanup on error. This flaw allows an attacker with the ability to produce the error to crash the system...

RHEL 8 : kernel (RHSA-2020:4685)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4685 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bluetooth: heap buffer...

How to Prevent Pwned and Reused Passwords in Your Active Directory

Many businesses are currently looking at how to bolster security across their organization as the pandemic and remote work situation continues to progress towards the end of the year. As organizations continue to implement security measures to protect business-critical data, there is an extremely...

CVE-2020-11162

u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

Buffer overflow

u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...