LibreOffice 6.2.6 / 6.3.1 Security Control Bypass (Windows)

According to its self-reported version, the LibreOffice application running on the remote host is prior to 6.2.6. It is, therefore, affected by a flaw in how LibreOffice sanitizes user supplied input when decoding URL encoded characters in the macro location. This can result in macros within a...

Slack: Remote Code Execution in Slack desktop apps + bonus

Summary With any in-app redirect - logic/open redirect, HTML or javascript injection it's possible to execute arbitrary code within Slack desktop apps. This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass and a RCE Javascript payload. Th...

CVE-2020-1765

Removed by vendor...

CVE-2019-0057 NFX Series: An attacker may be able to take control of the JDM application and subsequently the entire system.

An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos Device Manager JDM application and take control of the system. This issue affects: Juniper Networks Junos OS versions prior to 18.2R1,...

Moderate: Red Hat Security Advisory: libcgroup security update

An update for libcgroup is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Qualys Policy Compliance Notification: Policy Library Updates (April, May)

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Linear eMerge E3-Series Path Traversal Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control device from Nortek Security & Control USA. A path traversal vulnerability exists in the Linear eMerge E3-Series device, which stems from the program failing to properly handle sequences such as '... /' and other sequences...

Nortek Security & Control Linear eMerge E3-Series Buffer Overflow Vulnerability

The Nortek Security & Control Linear eMerge E3-Series is an access control system from Nortek Security & Control, USA. A buffer overflow vulnerability exists in the Linear eMerge E3-Series device and can be exploited by an attacker to execute arbitrary code...

CVE-2019-7256

Linear eMerge E3-Series devices allow Command Injections. Recent assessments: h00die-gr3y at December 03, 2022 12:46pm UTC reported: Building Automation and Access Control systems are at the heart of many critical infrastructures, and their security is vital. Executing attacks on these systems ma...

Foxit PDF SDK ActiveX < 5.5.1 Multiple Vulnerabilities

According to its version, the Foxit PDF SDK ActiveX application installed on the remote Windows host is prior to 5.5.1. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists due to a lack of security permission control which could allow LaunchURL...

Microsoft Windows Latest Servicing Stack Updates-Defense in Depth (KB4500640)

This host is missing an important security update according to Microsoft KB4500640. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

U.S. Dept Of Defense: █████ - Pre-generation of VIEWSTATE allows CAC bypass

Summary: As of today, ███ is back online https://███████. █████████ allows users to check a box labeled Require CAC for Pick-up. This option requires users to present their CAC in order to download files. As explained by ███: Choosing this option, however, does add a significant degree of assuran...

PT-2018-2743

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the "Security Control Center" component. This allows a remote attacker to execute arbitrary...

PT-2018-2744

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the "Security Control Center" component. This could allow a remote attacker to execute...

PT-2018-2746

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue is related to the "Security Control Center" component of Dr.Web Enterprise Security Suite, specifically with the error reporting mechanism. An attacker can...

Microsoft Windows Latest Servicing Stack Updates-Defense in Depth (KB4470788)

This host is missing an important security update according to Microsoft KB4470788. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

PT-2018-2747

Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue is related to the "Security Control Center" component of Dr.Web Enterprise Security Suite, specifically with the document export mechanism. This could allow...

Microsoft Windows Security Bypass and Latest Servicing Stack Updates-Defense in Depth (KB4465663)

This host is missing an important security update according to Microsoft KB4465663. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Microsoft Windows Security Bypass and Latest Servicing Stack Updates-Defense in Depth (KB4465659)

This host is missing an important security update according to Microsoft KB4465659. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...