Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:1357-1 Rating: important References: 1065729 1148868 1152489 1154353 1159886 1167773 1170774 1173746 1176940 1184439 1184804 1185302 1185677 1185726 1185762 1187167 1188067 1188651 1188986 1189297...

Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with...

GHSA-Q324-Q795-2Q5P Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with...

PT-2021-24447

Name of the Vulnerable Software and Affected Versions: openapi-cli versions prior to 1.0.0-beta.59 Description: The issue allows path traversal when the preview-docs command is executed in a directory containing files with a question mark ? in their name, provided the attacker is aware of the fil...

Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability designated as CVE-2021-40444 is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:2790-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2790-1 advisory. - CVE-2021-22930: http2: fixes use after free on close in stream canceling bsc1188917. Tenable has extracted the preceding description block...

Google Docs Scams Still Pose a Threat

A 2017 worm caused havoc across the internet. One researcher is warning that despite new protections put in place, it could still happen again...

CheckMK management web console cross-site scripting vulnerability

CheckMK management web console is an application. Based on Asciidoctor and automatically available on HTML docs.checkmk.com. CheckMK management web console suffers from a cross-site scripting vulnerability that could be exploited by attackers to open a backdoor on the device using HTML content...

Description of the security update for SharePoint Enterprise Server 2016: July 13, 2021 (KB5001976)

None None...

XSS Vulnerability in Xunfei Documents of KUDA Xunfei Co.

Xunfei Documents is an online document app produced by KUDA Xunfei that supports simultaneous editing by multiple people and multiple ends. A XSS vulnerability exists in Xunfei Document of KUDA Xunfei Corporation, which can be exploited by an attacker to obtain an administrator cookie...

Threat actors using Google Docs exploit to spread phishing links

By Habiba Rashid Cybercriminals have started employing a new phishing attack that abuses the popularity of Google Drive and Docs to bypass security filters. This is a post from HackRead.com Read the original post: Threat actors using Google Docs exploit to spread phishing links...

Threat Actors Use Google Docs to Host Phishing Attacks

Threat actors are exploiting Google Docs by hosting their attacks within the web-based document service in a new phishing campaign that delivers malicious links aimed at stealing victims’ credentials. Researchers at email and collaboration security firm Avanan discovered the campaign, which is th...

XSS vulnerability in graphite documents

Graphite Docs is an enterprise office service software that supports real-time collaboration in the cloud features analogous to Google Docs, Quip. A XSS vulnerability exists in Graphite Documents. Attackers can use this vulnerability to obtain sensitive information such as user cookies...

Google Workspace Now Offers Client-side Encryption For Drive and Docs

Google on Monday announced that it's rolling out client-side encryption to Google Workspace formerly G Suite, thereby giving its enterprise customers direct control of encryption keys and the identity service they choose to access those keys. "With client-side encryption, customer data is...

XSS Vulnerability in Cyberdrive Documents

Xunfei Documents is an online document app produced by KUDA Xunfei that supports multiple people editing at the same time on multiple devices, such as computers, mobile phones, tablets, and other types of devices to view and modify documents anytime, anywhere, and easily improve work efficiency...

CVE-2021-32662

Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In @backstage/techdocs-common versions prior to 0.6.3, a malicious actor could read sensitive files from the environment where TechDocs documentation is buil...

PT-2021-19840

Name of the Vulnerable Software and Affected Versions @backstage/techdocs-common versions prior to 0.6.3 Description A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs dir in mkdocs.yml. These...

CVE-2020-25634

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected...

Design/Logic Flaw

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected...

CVE-2020-25634

A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected...