WESEEK GROWI path traversal vulnerability (CNVD-2021-16348)

GROWI is a team collaboration software. A path traversal vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited to read and/or delete arbitrary paths by sending a specially crafted request...

WESEEK GROWI Input Validation Error Vulnerability (CNVD-2021-16346)

GROWI is a team collaboration software. An input validation error vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by remote attackers to overwrite files on the server with arbitrary code execution...

AppSec Bites: Implementing DevOps? What Security Teams Need to Know. (Part 4)

DevOps practices can be difficult to implement for any business. While the overall goal is to streamline the business and join the development and operations sides of things together, the first step needs to be a strong relationship between DevOps and security teams otherwise things will typicall...

CVE-2021-22863

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker woul...

CVE-2021-22863

CVE-2021-22863 is an improper access control vulnerability in GitHub Enterprise Server’s GraphQL API. It allowed authenticated users to modify the maintainer collaboration permission on a pull request, potentially exposing head branches of repos where they are a maintainer. Affected versions span...

Securing and governing data in a new hybrid work reality

The past year has led to an evolution in not only how we think about work, but more importantly, where work gets done. Arguably, gone are the days that your organization’s data is limited to the protected confines of your corporate network as your people continue to work remotely, return in some...

Securing and governing data in a new hybrid work reality

The past year has led to an evolution in not only how we think about work, but more importantly, where work gets done. Arguably, gone are the days that your organization’s data is limited to the protected confines of your corporate network as your people continue to work remotely, return in some...

Microsoft SharePoint Spoofing Vulnerability (NVD-C-2021-53253)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. Microsoft SharePoint ...

Microsoft SharePoint Remote Code Execution Vulnerability (CNVD-2021-48893)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A remote code executi...

The vulnerability of the component of the software framework for transmitting real-time streaming video and audio via WebRTC in the Intel Collaboration Suite, which allows attackers to enhance their privileges.

The vulnerability of the component of the software framework for transmitting real-time streaming video and audio in the Intel Collaboration Suite for WebRTC is related to inadequate control of data streams. Exploiting this vulnerability can allow a malicious actor to enhance their privileges...

[SECURITY] Fedora 32 Update: subversion-1.14.1-1.fc32

Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file...

Microsoft Internal Solorigate Investigation – Final Update

We believe the Solorigate incident is an opportunity to work with the community, to share information, strengthen defenses and respond to attacks. We have now completed our internal investigation into the activity of the actor and want to share our findings, which confirm that we found no evidenc...

CVE-2020-12339

Insufficient control flow management in the API for the IntelR Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access...

CVE-2020-12339

Insufficient control flow management in the API for the IntelR Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access...

CVE-2020-12339

The vulnerability CVE-2020-12339 affects Intel® Collaboration Suite for WebRTC before version 4.3.1, due to insufficient control flow management in the API. An authenticated user could potentially escalate privileges via network access, with there being no user interaction required (per CVSS 3.1)...

CVE-2020-12339

Insufficient control flow management in the API for the IntelR Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access...

CVE-2021-21301

Wire is an open-source collaboration platform. In Wire for iOS iPhone and iPad before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the...

Design/Logic Flaw

Wire is an open-source collaboration platform. In Wire for iOS iPhone and iPad before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the...

Intel Collaboration Suite for WebRTC Security Vulnerability

Intel Collaboration Suite for WebRTC is an Intel WebRTC collaboration suite from Intel. A security vulnerability exists in Intel Collaboration Suite for WebRTC that arises from a lack of effective privilege-granting and access-control measures in a networked system or product...

Sigma Rules to Live Your Best SOC Life

Security Operations is a 24 x 7 job. It does not stop for weekends or holidays or even that much-needed coffee break after the first hour of the shift is complete. We all know this. Every SOC engineer is hoping for some rest at some point. One of my favorite jokes when talking about Security...