Google takes on Docs notification spammers

Cloud-based document suites have always been a hot target for scammers. When it’s easy to dip in and out for collaboration purposes, or just share things generally, then its likely that bad people will want in on the action. In 2019, Google calendar users were wading through endless spam...

CVE-2022-23375

WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...

Security update for firejail (important)

openSUSE Security Update: Security update for firejail Announcement ID: openSUSE-SU-2022:0037-1 Rating: important References: 1195880 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: This update for firejail fixes the...

org.apache.nifi.registry:nifi-registry-assembly (>=0.1.0, <=0.5.0), org.apache.nifi.registry:nifi-registry-docs (>=0.4.0, <=0.5.0) potentially affected by CVE-2020-9482 via org.apache.nifi.registry:nifi-registry-web-api (>=0.1.0, <=0.5.0)

org.apache.nifi.registry:nifi-registry-web-api MAVEN version =0.1.0, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2020-9482 Source advisory: GHSA-RCWJ-2HJ2-VMJJ...

org.apache.nifi.registry:nifi-registry-assembly (>=0.1.0, <=0.5.0), org.apache.nifi.registry:nifi-registry-docs (>=0.4.0, <=0.5.0) potentially affected by CVE-2020-9482 via org.apache.nifi.registry:nifi-registry-web-api (>=0.1.0, <=0.5.0)

org.apache.nifi.registry:nifi-registry-web-api MAVEN version =0.1.0, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2020-9482 Source advisory: OSV:GHSA-RCWJ-2HJ2-VMJJ...

Mageia: Security Advisory (MGASA-2018-0055)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2017-0117)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 : polkit (ELSA-2022-0274)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0274 advisory. 0.112-26.0.1 - Increase timeout to avoid defunct processes Orabug: 26930744 0.112-26.1 - pkexec: argv overflow results in local privilege esc. - Resolves:...

Attackers Exploit Flaw in Google Docs’ Comments Feature

Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered. Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of...

Failed transfer with low level call could be overlooked

Handle harleythedog Vulnerability details Impact There are several places where low level call is used within the contract. In particular, in SavingsAccount.sol, the external withdraw function has the to argument, which is eventually used in this code in transfer: bool success, = to.callvalue:...

Kubernetes: Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose"

Report Submission Form Summary: Kubernetes have a github project github.com/kubernetes/kompose In the project there is a doc which have installation steps In the steps, doc is referring to another github account repository to clone it and install. But the github account was not registered on...

GHSA-GP2F-254M-RH32 Unauthorized access to data in @sap-cloud-sdk/core

Impact This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations. In some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:1357-1 Rating: important References: 1065729 1148868 1152489 1154353 1159886 1167773 1170774 1173746 1176940 1184439 1184804 1185302 1185677 1185726 1185762 1187167 1188067 1188651 1188986 1189297...

Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with...

GHSA-Q324-Q795-2Q5P Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name. Patches It was patched starting from 1.0.0-beta.59 Workarounds Do not run openapi-cli preview-docs command in the folder which contains files with...

PT-2021-24447

Name of the Vulnerable Software and Affected Versions: openapi-cli versions prior to 1.0.0-beta.59 Description: The issue allows path traversal when the preview-docs command is executed in a directory containing files with a question mark ? in their name, provided the attacker is aware of the fil...

Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Microsoft has disclosed the existence of a new zero-day vulnerability that affects multiple versions of Windows. This vulnerability designated as CVE-2021-40444 is currently delivered via malicious Office 365 documents and requires user input to open the file to trigger...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2021:2790-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2790-1 advisory. - CVE-2021-22930: http2: fixes use after free on close in stream canceling bsc1188917. Tenable has extracted the preceding description block...

Google Docs Scams Still Pose a Threat

A 2017 worm caused havoc across the internet. One researcher is warning that despite new protections put in place, it could still happen again...

CheckMK management web console cross-site scripting vulnerability

CheckMK management web console is an application. Based on Asciidoctor and automatically available on HTML docs.checkmk.com. CheckMK management web console suffers from a cross-site scripting vulnerability that could be exploited by attackers to open a backdoor on the device using HTML content...