PT-2021-6973 · Microsoft · Office

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Description: The issue is related to a component of Microsoft Office Graphics, where an incompatibility in resource access types can be exploited. This can allow an attacker to execute arbitrar...

GHSA-XW4P-CRPJ-VJX2 A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security...

VMware vRealize Operations 授权问题漏洞

vmware VMware vRealize Operations is an application from vmware, Inc. A unified, AI-based platform for private, hybrid and multi-cloud environments that delivers IT operations management on autopilot. An authorization issue vulnerability exists in VMware vRealize Operations that stems from the...

Privilege Escalation

HAProxy is vulnerable to privilege escalation. The vulnerability exists due to a flaw in HTTP method name that when it contains a space followed by the name of a protected resource, it is possible that a server would interpret this as a request for that protected resource, such as in the "GET...

Microsoft delivers comprehensive solution to battle rise in consent phishing emails

Microsoft threat analysts are tracking a continued increase in consent phishing emails, also called illicit consent grants, that abuse OAuth request links in an attempt to trick recipients into granting attacker-owned apps permissions to access sensitive data. This blog offers a look into the...

CVE-2012-1102

It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used...

CVE-2012-1102

It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used...

NinjaRMM Access Control Error Vulnerability

NinjaRMM is a remote monitoring and management software from NinjaRMM USA. Improve business efficiency by combining monitoring, alerting, patching, antivirus, backup and IT automation all in a single management platform. An Access Control Error vulnerability exists in NinjaRMM, which arises from...

[SECURITY] [DLA 2688-1] jetty9 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2688-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler June 17, 2021 https://wiki.debian.org/LTS -...

IBM Security Guardium Access Control Error Vulnerability

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium suffers from an Access Control Error vulnerabili...

Design/Logic Flaw

In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user's permissions, allowing read-access to resources beyond what those users were explicitly allowed to access...

Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can...

The vulnerability of the fs/fuse/fuse_i.h file in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the fs/fuse/fusei.h file in the Linux operating system’s kernel is related to access to resources through incompatible types. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the GPU Display Driver’s driver lies in the simultaneous execution using shared resources with improper synchronization, allowing a hacker to cause service failure.

The vulnerability of the GPU Display Driver’s driver lies in the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

GHSA-F6HM-88X3-MFJV A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host

Impact The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the...

Citrix Workspace App Assistance for Non-Admins

Clickhere to download Citrix Workspace App. You have been directed to this article because you have questions about or need assistance with Citrix Workspace app and you are NOT an administrator or technical contact for your organization. As a non-admin user of Citrix Workspace app, you must conta...

Intel Ethernet Controllers Access Control Error Vulnerability

Intel Ethernet Controllers is an Ethernet controller from Intel Corporation USA. An Access Control Error vulnerability exists in the Intel 700-series of Ethernet Controllers that arises from a network system or product that does not properly restrict access to resources from unauthorized roles...

Redwood Report2Web File Inclusion Vulnerability

Redwood Report2Web is a web platform from Redwood Corporation that provides users with automated report generation capabilities. A file inclusion vulnerability exists in Redwood Report2Web version 4.3.4.5, which originates from a vulnerability that allows remote attackers to present external...

Unspecified Vulnerability in JetBrains YouTrack

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in JetBrains YouTrack that stems from doing improper resourc...

CVE-2021-25766

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made...