XWiki Platform 安全漏洞

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform, which stems from the fact that any user with commenting privileges can use an asynchronous macro that allows them to execute an...

PT-2023-20672 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 12.10 through 14.4.6 XWiki Platform versions 13.10.9 and earlier XWiki Platform version 14.9 is not affected, but versions prior to 14.9 are vulnerable, however since 14.4.7 is a fixed version, we consider versions pri...

Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies

A spear-phishing campaign targeting Indian government entities aims to deploy an updated version of a backdoor called ReverseRAT. Cybersecurity firm ThreatMon attributed the activity to a threat actor tracked as SideCopy. SideCopy is a threat group of Pakistani origin that shares overlaps with...

Researchers Warn of ReverseRAT Backdoor Targeting Indian Government Agencies

A spear-phishing campaign targeting Indian government entities aims to deploy an updated version of a backdoor called ReverseRAT. Cybersecurity firm ThreatMon attributed the activity to a threat actor tracked as SideCopy. SideCopy is a threat group of Pakistani origin that shares overlaps with...

org.jenkins-ci.plugins.workflow:workflow-aggregator (>=2.0 <=2.2), org.jenkins-ci.plugins:token-macro (=2.2) +1 more potentially affected by CVE-2023-25762 via org.jenkins-ci.plugins:pipeline-build-step (>=2.0 <=2.1)

org.jenkins-ci.plugins:pipeline-build-step MAVEN version =2.0, =2.0, =1.0.0, =1.0.8 Source cves: CVE-2023-25762 Source advisory: OSV:GHSA-9J65-3F2Q-8Q2R...

SUSE CVE-2006-2198

OpenOffice.org aka StarOffice 1.1.x up to 1.1.5 and 2.0.x before 2.0.3 allows user-assisted attackers to conduct unauthorized activities via an OpenOffice document with a malicious BASIC macro, which is executed without prompting the user...

SUSE CVE-2008-0948

Buffer overflow in the RPC library lib/rpc/rpcdtablesize.c used by libgssrpc and kadmind in MIT Kerberos 5 krb5 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FDSETSIZE macro, allows remote attackers to cause a denial of service crash and...

SUSE CVE-2008-1687

The 1 maketemp and 2 mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename...

SUSE CVE-2010-0136

OpenOffice.org OOo 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications VBA macro security settings, which allows remote attackers to run arbitrary macros via a crafted document...

SUSE CVE-2010-0395

OpenOffice.org 2.x and 3.0 before 3.2.1 allows user-assisted remote attackers to bypass Python macro security restrictions and execute arbitrary Python code via a crafted OpenDocument Text ODT file that triggers code execution when the macro directory structure is previewed...

SUSE CVE-2010-1166

The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service memory corruption and daemon crash or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition...

SUSE CVE-2011-1761

Multiple stack-based buffer overflows in the 1 abcnewmacro and 2 abcnewumacro functions in src/loadabc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted ABC file. NOTE: some of these details are obtained fr...

SUSE CVE-2013-2120

The %password... macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack...

SUSE CVE-2013-6425

Integer underflow in the pixmantrapezoidvalid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service crash via a negative bottom value...

SUSE CVE-2014-3560

NetBIOS name services daemon nmbd in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in stringwrappers.h...

SUSE CVE-2015-0823

Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the...

SUSE CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

SUSE CVE-2017-9274

A shell command injection in the obs-service-sourcevalidator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs...

SUSE CVE-2017-9751

opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during...

SUSE CVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name...