Resource Based Constrained Delegation

Microsoft in an attempt to provide more flexibility to domain users enabled owner of resources to configure which accounts are trusted and allowed to delegate… Continue reading - Resource Based Constrained Delegation...

PT-2021-7047

Name of the Vulnerable Software and Affected Versions Microsoft Surface Pro 3 affected versions not specified Description The vulnerability is related to errors in authorization, allowing an attacker to bypass existing security restrictions. It is associated with the TPM Carte Blanche attack, whi...

KindEdirot Cross-Site Request Forgery Vulnerability

Kindeditor is a lightweight open source web-based HTML rich text editor from the Kindeditor community.KindEdirot suffers from a cross-site request forgery vulnerability, which stems from WEB applications that do not adequately validate that requests come from trusted users. An attacker could...

in chatwoot/chatwoot

Description chatwoot failed to validate the original email when a user changing his/her email address in Profile Setting, An attacker may use the mechanism to forge arbitrary email（especially in trusted domain） Proof of Concept my original email is：[email protected], and I had confirmed it b...

OESA-2021-1384 tpm2-tools security update

The package contains the code for the TPM Trusted Platform Module 2.0 tools based on tpm2-tss. The tpm2-tools projects aims to deliver both low-level and aggregate command line tools that provide access to a tpm2.0 compatible device. Security Fixes: A flaw was found in tpm2-tools in versions befo...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2023-05245)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

Apache OpenOffice Data Forgery Issue Vulnerability

Apache OpenOffice is an open source office software suite from the Apache Apache Foundation. The suite contains text documents, spreadsheets, presentations, drawings, databases, etc. Apache OpenOffice is vulnerable to a data forgery issue in versions prior to 4.1.10, which stems from a networked...

openSUSE 15 Security Update : mbedtls (openSUSE-SU-2021:1344-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1344-1 advisory. - In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtai...

CVE-2021-41832

It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25635 for the LibreOffice advisory...

CVE-2021-41830 Double Certificate Attack

It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25633 for the LibreOffice advisory...

LibreOffice 数据伪造问题漏洞

LibreOffice is an open source office software suite from The Document Foundation. LibreOffice suffers from a Data Forgery Problem vulnerability that stems from the application not properly checking the digital signatures of ODF documents. An attacker could use the vulnerability to change the...

Apache OpenOffice 数据伪造问题漏洞

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents , spreadsheets , presentations , drawings , databases and so on. Versions of Apache OpenOffice prior to 4.1.10 contain a data forgery issue vulnerability that can be...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2021-82421)

IBM Sterling B2B Integrator is a transaction engine, a set of components that run the processes you define and manage based on your business needs.A cross-site scripting vulnerability exists in IBM Sterling B2B Integrator versions 5.2.0.0-6.0.3.4, 6.1.0.0-6.1.0.3. An attacker could exploit the...

Myucms cross-site request forgery vulnerability

MyuCms is a content management system based on ThinkPhp developed specifically for enterprises. myucms has a cross-site request forgery vulnerability in v2.2.1, which stems from a sql method in the product controllerindex.php file that does not correctly determine that the request originates from...

CVE-2021-20481

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2021-20561

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

Cross site scripting

IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2021-20561

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2021-20481

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2021-20481

CVE-2021-20481 (IBM Sterling File Gateway) is a cross-site scripting vulnerability affecting IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0. The issue allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and leading to credential disclosure within a ...