Security Bulletin: iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity

Summary iText.jar in Tom Sawyer Perspective is vulnerable to XML External Entity used by IBM Tivoli Network Manager ITNM IP Edition. Vulnerability Details CVEID:CVE-2017-9096 DESCRIPTION: iText PDF Library could allow a remote authenticated attacker to obtain sensitive information, caused by an X...

See product news and on-demand sessions from Microsoft Secure

“Great speakers and very knowledgeable.” “Brilliant.” “Wonderful and very useful.” The first Microsoft Secure on March 28, 2023, was a huge success—as this attendee feedback shows. Our virtual event brought together more than 20,000 security professionals eager to learn security best practices an...

Akamai’s Perspective on April’s Patch Tuesday 2023

...

CVE-2023-29417

An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a...

CVE-2023-29417

An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a...

GHSA-FQ8Q-55V3-2986 Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 1.5.1. Workarounds Apply the patch...

Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 1.5.1. Workarounds Apply the patch...

CVE-2023-28850

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...

Code injection

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...

CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...

CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...

CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...

CVE-2023-28850

The CVE concerns Pimcore Perspective Editor vulnerability allowing stored XSS via perspective name handling, enabling cookie theft and potential unauthorized account access. Affected component: Pimcore Perspective Editor (web UI) in versions prior to 1.5.1; the issue stems from insufficient input...

PT-2023-22007 · Pimcore · Pimcore Perspective Editor

Name of the Vulnerable Software and Affected Versions: Pimcore Perspective Editor versions prior to 1.5.1 Description: This issue has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites...

CVE-2023-28850: Improper Neutralization of Input During Web Page Generation

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...

Stored cross site scripting vulnerability in Save grid option in pimcore dashboard

Description Stored cross site scripting vulnerability in Save grid option in pimcore dashboard. Proof of Concept 1. Login to the demo account https://11.x-dev.pimcore.fun/admin/login 2. On left side menu go to document -- perspective -- cdp https://11.x-dev.pimcore.fun/admin/?perspective=CDP 3. i...

XSS Stored in perspective name

Description Hello team, I found an xss stored when adding a perspective name as shown in the gif below Proof of Concept...

How much security is enough?

According to a prominent Soviet science fiction writer, beauty is a fine line, a razors edge between two opposites locked in a never-ending battle. Today, we would put it less poetically as an ideal compromise between contradictions. An elegant, or beautiful, design is one that allows reaching th...

CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...

CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...