CVE-2023-42436: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

PT-2023-28340 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v3.4.0 Description: A stored cross-site scripting issue exists in the presentation feature. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

Design/Logic Flaw

Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false...

[SECURITY] Fedora 38 Update: libreoffice-7.5.9.2-1.fc38

LibreOffice is an Open Source, community-developed, office productivity suite. It includes the key desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor and drawing program, with a user interface and feature set similar to other office suites...

Microsoft Dynamics 365 Spoofing

The vulnerability of the customer feedback management application of Microsoft Dynamics 365 involves information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to perform a spoofing attack remotely...

Command injection

Command injection in main/lp/openofficepresentation.class.php in Chamilo LMS = v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters...

Chamilo LMS Security Vulnerability

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo LMS v1.11.24 and earlier versions,...

ROS-20231115-04

Visual Studio Coden source code editor vulnerability related to improper control of code generation. code generation. Exploitation of the vulnerability may allow an attacker to execute arbitrary code Visual Studio Code source code editor vulnerability is related to insufficient protection of...

CVE-2023-29043

CVE-2023-29043 describes a vulnerability where presentations may contain references to images that are user-controlled, allowing script code to be processed during document editing. The encoding of the relevant attribute is intended to avoid script execution. Concrete details from connected docs ...

Microsoft Office Spear Phishing

The vulnerability of the Microsoft Office suite is related to errors in information representation by the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

Microsoft Office Spoofing

The vulnerability of the Microsoft Office suite is related to errors in information representation by the user interface. Exploiting this vulnerability allows a remote attacker to perform spoofing attacks...

PT-2023-5046

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description The issue is related to insufficient input validation in the .NET Framework, which can be exploited to execute arbitrary code. This can allow an attacker to run remote code execution...

OneNote Spear Phishing

The vulnerability of the Microsoft OneNote note-taking software relates to information representation errors in the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

Microsoft SharePoint Server Spoofing

The vulnerability of Microsoft SharePoint Server packages is related to errors in information presentation by the user interface. Exploiting this vulnerability can allow a malicious actor to perform a spoofing attack remotely...

Microsoft .NET Framework Spear Phishing

Vulnerability of the Microsoft .NET Framework software platform, related to errors in user interface information presentation. Exploitation of this vulnerability can allow attackers to perform spear-phishing attacks remotely...

Microsoft Outlook Spoofing

The vulnerability of the Microsoft Outlook email client is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to perform a spoofing attack remotely...

Microsoft SharePoint Server Spoofing

The vulnerability of Microsoft SharePoint Server packages is related to errors in information presentation by the user interface. Exploiting this vulnerability can allow a malicious actor to perform a spoofing attack remotely...

Blind SSRF When Uploading Presentation (mitigation bypass)

Description This is actually a bypass of CVE-2023-33176 when i able to perform SSRF to internal network. Proof of Concept As we already know, we can upload files via api /bigbluebutton/api/insertDocument using a remote url. PresentationUrlDownloadServicesavePresentation is the method to handle th...

How To Present SecOps Metrics (The Right Way)

SecOps metrics can be a gold mine of potential for informing better business decisions, but 78% of CEOs say they don’t have adequate data on risk exposure to make good decisions. Even when they do see the right data, 82% are inclined to “trust their gut” anyway. Here lies the disconnect between...

OneNote Spoofing

The vulnerability of the Microsoft OneNote note-taking software relates to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...