CVE-2017-14198

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution RCE via a maliciously crafted timeformat tag...

CVE-2017-14196

An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue in the 'File Bridge' plugin allowed the existence of files outside of the bridged path to be confirmed...

CVE-2017-14197

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins...

CVE-2017-14198

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution RCE via a maliciously crafted timeformat tag...

CVE-2017-14197

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins...

Cross site scripting

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins...

Path traversal

An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue in the 'File Bridge' plugin allowed the existence of files outside of the bridged path to be confirmed...

Remote code execution

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution RCE via a maliciously crafted timeformat tag...

CVE-2017-14197

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins...

CVE-2017-14197

Squiz Matrix WYSIWYG plugin is affected by multiple reflected XSS issues. Affected: Matrix WYSIWYG plugins in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Impact: remote attacker can inject arbitrary web script or HTML. Remediation: upgrade to 5.3.6.1 or 5.4.1.3 (or newer) where fixed.

CVE-2017-14196

Summary: CVE-2017-14196 is a path traversal information-disclosure vulnerability in Squiz Matrix, affecting the File Bridge plugin. Affected versions: 5.3 through 5.3.6.1 and 5.4.1.3. Root cause/impact: a path traversal flaw allows an attacker to confirm the existence of files outside the bridged...

CVE-2017-14198

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution RCE via a maliciously crafted timeformat tag...

CVE-2017-14198

Summary: CVE-2017-14198 affects Squiz Matrix prior to 5.3.6.1 and 5.4.x prior to 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution (RCE) via a maliciously crafted time_format tag. The connected CNVD/NVD entries corroborate the affected versions an...

November 27, 2017—KB4051034 (Preview of Monthly Rollup)

None None...

November 27, 2017—KB4050946 (Preview of Monthly Rollup)

None None...

November 22, 2017—KB4055254 (OS Build 15063.729)

None None...

November 21, 2017—KB4055038

None None...

HP Matrix Operating Environment Point Hijacking Vulnerability (CNVD-2017-37920)

HP Matrix Operating Environment is a suite of cloud management software designed for infrastructure services from Hewlett-Packard HP. A point hijacking vulnerability exists in HP Matrix Operating Environment version 7.6 LR1, which can be exploited by an attacker to conduct a clickjacking attack v...

HP Matrix Operating Environment Point Hijacking Vulnerability

HP Matrix Operating Environment is a suite of cloud management software designed for infrastructure services from Hewlett-Packard HP. A point hijacking vulnerability exists in HP Matrix Operating Environment version 7.6 LR1, which can be exploited by an attacker to conduct a clickjacking attack v...

Partner Perspectives – Detecting Ransomware: Behind the Scenes of an Attack

Editor's Note: This blog originally appeared on RedCanary.com Ransomware has been the threat of the year. If you’ve had even a lazy eye on current events in information security, you’ve heard about the WannaCry infection that recently took out endpoints for hundreds of companies. By now you’ve...