167 matches found
Akamai’s Perspective on April’s Patch Tuesday 2023
...
CVE-2023-29417
An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a...
CVE-2023-29417
An issue was discovered in libbzip3.a in bzip3 1.2.2. There is a bz3decompress out-of-bounds read in certain situations where buffers passed to bzip3 do not contain enough space to be filled with decompressed data. NOTE: the vendor's perspective is that the observed behavior can only occur for a...
GHSA-FQ8Q-55V3-2986 Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 1.5.1. Workarounds Apply the patch...
Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 1.5.1. Workarounds Apply the patch...
CVE-2023-28850
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...
Code injection
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...
CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...
CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...
CVE-2023-28850 Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name
Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other...
CVE-2023-28850
The CVE concerns Pimcore Perspective Editor vulnerability allowing stored XSS via perspective name handling, enabling cookie theft and potential unauthorized account access. Affected component: Pimcore Perspective Editor (web UI) in versions prior to 1.5.1; the issue stems from insufficient input...
PT-2023-22007 · Pimcore · Pimcore Perspective Editor
Name of the Vulnerable Software and Affected Versions: Pimcore Perspective Editor versions prior to 1.5.1 Description: This issue has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites...
Stored cross site scripting vulnerability in Save grid option in pimcore dashboard
Description Stored cross site scripting vulnerability in Save grid option in pimcore dashboard. Proof of Concept 1. Login to the demo account https://11.x-dev.pimcore.fun/admin/login 2. On left side menu go to document -- perspective -- cdp https://11.x-dev.pimcore.fun/admin/?perspective=CDP 3. i...
XSS Stored in perspective name
Description Hello team, I found an xss stored when adding a perspective name as shown in the gif below Proof of Concept...
How much security is enough?
According to a prominent Soviet science fiction writer, beauty is a fine line, a razors edge between two opposites locked in a never-ending battle. Today, we would put it less poetically as an ideal compromise between contradictions. An elegant, or beautiful, design is one that allows reaching th...
CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach
The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...
CSO perspective: Why a strong IAM strategy is key to an organization’s cybersecurity approach
The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Alissa “Dr. Jay”...
MAL-2022-1201 Malicious code in aws-perspective (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75ea46917a73a9d1a8b12320912bea4deb98b13b0cdd6cb1822f6b9d6455a4c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in aws-perspective (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75ea46917a73a9d1a8b12320912bea4deb98b13b0cdd6cb1822f6b9d6455a4c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-27948
Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended...