Code injection

Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborati...

CVE-2023-29045

CVE-2023-29045 affects Open-Xchange App Suite (documents operations, specifically drawing). The issue arises when drawing data can be manipulated to include invalid data types that may inject script code executed for collaborators in the same document. The root cause is lack of validation of oper...

CVE-2023-29045

Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborati...

CVE-2023-29044

Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get...

CVE-2023-29044

CVE-2023-29044 describes a cross-document collaboration flaw where operations could contain invalid data types and potentially script code, enabling code execution for users collaborating on the same document. Multiple connected sources (Open-Xchange App Suite, Red Hat advisory, Google Docs conte...

Russian Pair Charged with JFK Airport Taxi System Hack for Over 2 Years

By Waqas A cybersecurity incident apparently involving collaboration between Russians and Americans... This is a post from HackRead.com Read the original post: Russian Pair Charged with JFK Airport Taxi System Hack for Over 2 Years...

PentestPad: Platform for Pentest Teams

In the ever-evolving cybersecurity landscape, the game-changers are those who adapt and innovate swiftly. Pen test solutions not only supercharge productivity but also provide a crucial layer of objectivity, ensuring efficiency and exceptional accuracy. The synergy between a skilled penetration...

Securing Cloud Infrastructure Demands a New Mindset

Rising attacks on cloud infrastructure and services have created a ‘shared fate’ scenario for cloud providers and users, where a successful breach means everybody loses. Fresh thinking and closer collaboration can help avoid that outcome and better protect public cloud resources...

An integrated incident response solution with Microsoft and PwC

Today Microsoft Incident Response is excited to announce a new collaboration with PwC to expand our joint incident response and recovery capability. In this global alliance, Microsoft begins the initial containment and investigation, bringing a deep understanding of a company’s infrastructure to...

An integrated incident response solution with Microsoft and PwC

Today Microsoft Incident Response is excited to announce a new collaboration with PwC to expand our joint incident response and recovery capability. In this global alliance, Microsoft begins the initial containment and investigation, bringing a deep understanding of a company’s infrastructure to...

Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 44, 9.x < 9.0.0 Patch 37, 10.0.x < 10.0.5 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including: - A security related issue has been fixed to prevent javascript injection through help files. CVE-2007-1280 - A security related issue has been fixed which impacted one of...

SecuSphere - Efficient DevSecOps

SecuSphere is a comprehensive DevSecOps platform designed to streamline and enhance your organization's security posture throughout the software development life cycle. Our platform serves as a centralized hub for vulnerability management, security assessments, CI/CD pipeline integration, and...

Vulnerabilities fixed in Zimbra Collaboration Suite

Zimbra has fixed vulnerabilities in the Zimbra Collaboration Suite ZCS. A malicious party could exploit the vulnerabilities to execute attacks that could lead to the execution of an Cross-Site Scripting XSS Zimbra has released updates to fix the vulnerabilities in ZCS 10.0.5, 9.0.0 Patch 37 and...

vantage6 does not properly delete linked resources when deleting a collaboration

When a collaboration is deleted in vantage6, the linked resources such as tasks from that collaboration are not properly deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect, where if a collaboration with id=10 is deleted, and subsequently a ne...

GHSA-RF54-7QRR-96J6 vantage6 does not properly delete linked resources when deleting a collaboration

When a collaboration is deleted in vantage6, the linked resources such as tasks from that collaboration are not properly deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect, where if a collaboration with id=10 is deleted, and subsequently a ne...

Improper Access Control in vantage6

Impact The endpoint /api/collaboration/id/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, currently it is only checked if the user has permission to view the...

Hive Pro Unveils Revolutionary Platform Uni5 Xposure, Elevating the Potential of Threat Exposure Management

HERNDON, VA., Oct. 10, 2023 - Hive Pro®, a pioneer vendor in Threat Exposure Management today announced the highly-anticipated release of their new platform Uni5 Xposure, which debuts live at the GITEX GLOBAL trade show in Dubai, UAE and at Triangle InfoSec Conference in North Carolina, USA. Uni5...

Information Disclosure

vantage6server is vulnerable to Information Disclosure. The vulnerability exists because the deletion of collaboration links are not properly handled which allows an attacker to gain read access to some deleted collaborations...

Improper Access Control

vantage6-server is vulnerable to Improper Access Control. The vulnerability is due to improper permission checks in the /api/collaboration/id/task endpoint which retrieves tasks from a collaboration. Vantage only checks if the user has permission to view the collaboration, but should also check i...

CVE-2023-41882

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/id/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version...