CVE-2017-14198

Summary: CVE-2017-14198 affects Squiz Matrix prior to 5.3.6.1 and 5.4.x prior to 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution (RCE) via a maliciously crafted time_format tag. The connected CNVD/NVD entries corroborate the affected versions an...

CVE-2017-14197

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins...

CVE-2017-14198

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution RCE via a maliciously crafted timeformat tag...

CVE-2017-14196

Summary: CVE-2017-14196 is a path traversal information-disclosure vulnerability in Squiz Matrix, affecting the File Bridge plugin. Affected versions: 5.3 through 5.3.6.1 and 5.4.1.3. Root cause/impact: a path traversal flaw allows an attacker to confirm the existence of files outside the bridged...

CVE-2017-14197

Squiz Matrix WYSIWYG plugin is affected by multiple reflected XSS issues. Affected: Matrix WYSIWYG plugins in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Impact: remote attacker can inject arbitrary web script or HTML. Remediation: upgrade to 5.3.6.1 or 5.4.1.3 (or newer) where fixed.

PT-2017-13299

Name of the Vulnerable Software and Affected Versions Squiz Matrix versions prior to 5.3.6.1 Squiz Matrix versions 5.4.x prior to 5.4.1.3 Description An issue was discovered in Squiz Matrix, which involves multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins. Recommendatio...

PT-2017-13300

Name of the Vulnerable Software and Affected Versions Squiz Matrix versions prior to 5.3.6.1 Squiz Matrix versions 5.4.x prior to 5.4.1.3 Description An issue allows authenticated users with permissions to edit design assets to cause Remote Code Execution RCE via a maliciously crafted time format...

PT-2017-13298

Name of the Vulnerable Software and Affected Versions Squiz Matrix versions 5.3 through 5.3.6.1 Squiz Matrix version 5.4.1.3 Description An issue in the 'File Bridge' plugin causes an information disclosure due to a Path Traversal issue, allowing the existence of files outside of the bridged path...

CVE-2017-14198: Improper Control of Generation of Code

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution RCE via a maliciously crafted timeformat tag...

CVE-2017-14197: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting XSS issues in Matrix WYSIWYG plugins...

CVE-2017-14196: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue in the 'File Bridge' plugin allowed the existence of files outside of the bridged path to be confirmed...

November 27, 2017—KB4050946 (Preview of Monthly Rollup)

None None...

November 27, 2017—KB4051034 (Preview of Monthly Rollup)

None None...

November 22, 2017—KB4055254 (OS Build 15063.729)

None None...

November 21, 2017—KB4055038

None None...

HP Matrix Operating Environment Point Hijacking Vulnerability

HP Matrix Operating Environment is a suite of cloud management software designed for infrastructure services from Hewlett-Packard HP. A point hijacking vulnerability exists in HP Matrix Operating Environment version 7.6 LR1, which can be exploited by an attacker to conduct a clickjacking attack v...

HP Matrix Operating Environment Point Hijacking Vulnerability (CNVD-2017-37920)

HP Matrix Operating Environment is a suite of cloud management software designed for infrastructure services from Hewlett-Packard HP. A point hijacking vulnerability exists in HP Matrix Operating Environment version 7.6 LR1, which can be exploited by an attacker to conduct a clickjacking attack v...

HPESBMU03795 rev.1 - HPE Matrix Operating Environment, Multiple Remote Vulnerabilities

Potential Security Impact: Remote: Indirect Vulnerabilities, Unauthenticated Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP Matrix Operating Environment Software 7.6 LR1 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2017-89...

Partner Perspectives – Detecting Ransomware: Behind the Scenes of an Attack

Editor's Note: This blog originally appeared on RedCanary.com Ransomware has been the threat of the year. If you’ve had even a lazy eye on current events in information security, you’ve heard about the WannaCry infection that recently took out endpoints for hundreds of companies. By now you’ve...

ImageMagick ReadMATImage Function Denial of Service Vulnerability

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A denial of service vulnerability exists in the ReadMATImage function in coders/mat.c in ImageMagick, which can be exploited by an attacker to cause a denial of servic...