CVE-2023-1288

CVE-2023-1288 affects Dassault Systèmes ENOVIA Live Collaboration V6R2013xE. The connected sources describe an XML External Entity (XXE) vulnerability that allows an attacker to read local files on the server (remote read; potential RCE not clearly stated in the documents). The root cause is an X...

CVE-2023-1287 ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability

An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution...

CVE-2023-1287 ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability

An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution...

CVE-2023-1287

The CVE-2023-1287 entry describes an XSL template injection vulnerability in Dassault Systèmes ENOVIA Live Collaboration V6R2013xE that allows Remote Code Execution. Affected software is ENOVIA Live Collaboration V6R2013xE; root cause is an XSL template vulnerability in the product’s handling of ...

PT-2023-16862 · Dsm · Enovia Live Collaboration

Name of the Vulnerable Software and Affected Versions: ENOVIA Live Collaboration version V6R2013xE Description: An XSL template vulnerability in the software allows Remote Code Execution. Recommendations: For ENOVIA Live Collaboration version V6R2013xE, update to a version that fixes the XSL...

PT-2023-16863 · Dsm · Enovia Live Collaboration

Name of the Vulnerable Software and Affected Versions: ENOVIA Live Collaboration version V6R2013xE Description: An XML External Entity injection XXE vulnerability allows an attacker to read local files on the server, which can also lead to Remote File inclusions. Recommendations: For ENOVIA Live...

CVE-2023-1288: Improper Restriction of XML External Entity Reference

An XML External Entity injection XXE vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server...

CVE-2023-1287: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution...

Dassault Systèmes ENOVIA Live Collaboration V6R2013xE code-related vulnerabilities

Dassault Systèmes ENOVIA Live Collaboration V6R2013xE is a product lifecycle management PLM software from Dassault Systèmes, France. A code issue vulnerability exists in Dassault Systèmes ENOVIA Live Collaboration versions V6R2013xE through V6R2013xE FP, which stems from the discovery of an XML...

Dassault Systèmes ENOVIA Live Collaboration V6R2013xE has a code injection vulnerability

Dassault Systèmes ENOVIA Live Collaboration V6R2013xE is a Product Lifecycle Management PLM software from Dassault Systèmes, France. A security vulnerability exists in Dassault Systèmes ENOVIA Live Collaboration V6R2013xE version to V6R2013xE FP version, which stems from the discovery of an XSL...

What Tech Companies Should Look For in Cloud Security

The cloud's computing power and flexibility unlocks unprecedented speed and efficiency—a tech company's two best friends. But with that speed and efficiency comes new environments and touchpoints in an organization's footprint. That expanding attack surface brings along with it an expanding range...

Protecting Android clipboard content from unintended exposure

Considering mobile users often use the clipboard to copy and paste sensitive information, like passwords or payment information, clipboard contents can be an attractive target for cyberattacks. Leveraging clipboards can enable attackers to collect target information and exfiltrate useful data...

Securing a successful merger: Insights from MGM Studios

Hear from John Visneski, CISO of MGM Studios about how the organization fosters collaboration and transparency across business units using Wiz...

New research, tooling, and partnerships for more secure AI and machine learning

Today we’re on the verge of a monumental shift in the technology landscape that will forever change the security community. AI and machine learning may embody the most consequential technology advances of our lifetime, bringing huge opportunities to build, discover, and create a better world. Bra...

PT-2023-2845 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.15 through 9.0 Description: The issue in Zimbra Collaboration Suite is related to the use of certain JVM arguments in the mailbox manager, which can be exploited by an attacker with initial user access ...

PT-2023-2844 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 9.0 Description: The issue is related to a lack of account status check when sending emails using 2FA two-factor authentication in Zimbra Collaboration Suite. This can allow a remote attacker t...

PT-2023-2842 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.8.15 through 9.0 Description: An issue in Zimbra Collaboration allows for cross-site scripting XSS attacks. This can occur via one of the attributes of the webmail "/h/" endpoint, enabling the execution of...

Automating Vulnerability Management with Qualys VMDR & ServiceNow

With a growing number of cyber-attacks and the push to stay ahead of adversaries, the Vulnerability Management lifecycle has become necessary for ensuring enterprise-grade cyber resiliency. For many organizations, there is a persistent challenge in supporting vulnerability assessment and...

Regular Pen Testing Is Key to Resolving Conflict Between SecOps and DevOps

In an ideal world, security and development teams would be working together in perfect harmony. But we live in a world of competing priorities, where DevOps and security departments often butt heads with each other. Agility and security are often at odds with each other— if a new feature is...

SUSE CVE-2015-7829

Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete...