230 matches found
CVE-2023-29206 org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins
XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a...
Get integrated Microsoft Purview Information Protection in Adobe Acrobat—now available
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Data security and compliance are a top priority for leaders as cyberattacks are on the rise. In fact, attacks have increased by 32 percent in the past year, and 1 in 40 organizations...
Unauthorized Access Vulnerability in Isthmus Electronic Document Security Management System
Easetone electronic document security management system is an electronic document security encryption software. There is an unauthorized access vulnerability in Yisetong Electronic Document Security Management System, which can be exploited by attackers to obtain sensitive information...
SUSE CVE-2021-22134
A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been...
SUSE CVE-2021-22147
Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view...
CVE-2022-47414
If an attacker has access to the console for OpenKM and is authenticated, a stored XSS vulnerability is reachable in the document "note" functionality...
Arbitrary File Read Vulnerability in Istar Electronic Document Security Management System (CNVD-2023-09184)
Easetone electronic document security management system is an electronic document security encryption software. Yisetong Electronic Document Security Management System has an arbitrary file reading vulnerability that can be exploited by attackers to obtain sensitive information...
Command Execution Vulnerability in Electronic Document Security Management System of Beijing Yisaitong Technology Development Co.
Electronic Document Security Management System is an electronic document security encryption software. There is a command execution vulnerability in the Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd. that can be exploited by attackers to gain...
File Upload Vulnerability in Yisetong Electronic Document Security Management System (CNVD-2022-91374)
Electronic Document Security Management System abbreviation: CDG is an electronic document security protection software, which uses drive layer transparent encryption technology to prevent internal staff from leaking secrets and external personnel from illegally stealing core important data asset...
CVE-2022-37774
CVE-2022-37774 affects Maarch RM 2.8.3. A broken access-control flaw allows unauthenticated access to previews of certain documents (PDFs/emails) via a generated URL containing the MD5 hash, e.g. https://{url}/tmp/{MD5}. This URL can disclose the document without authentication, constituting a co...
PT-2022-26148 · Unknown · Opensearch
Name of the Vulnerable Software and Affected Versions: OpenSearch versions prior to 1.3.7 OpenSearch versions prior to 2.4.0 Description: There is an issue with the implementation of fine-grained access control rules, including document-level security, field-level security, and field masking, whe...
CVE-2022-36092
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes...
CVE-2022-36092 XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes...
PT-2022-23182 · Unknown · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform Old Core versions prior to 14.2 and 13.10.4 Description: The issue allows all rights checks that would normally prevent a user from viewing a document on a wiki to be bypassed using the login action and directly specified...
Multiple Vulnerabilities in Isthmus Electronic Document Security Management System
Yisetong electronic document security management system is an electronic document security protection software, the system utilizes the driver layer transparent encryption technology, through the encryption protection of electronic documents, to prevent internal employees from leaking and externa...
elasticsearch: Document disclosure flaw in the Elasticsearch suggester
Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled ...
elasticsearch: Document disclosure flaw when Document or Field Level Security is used
In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the...
SUSE-SU-2022:14898-1 Security update for htmldoc
This update for htmldoc fixes the following issues: - CVE-2019-19630: Fixed stack-based buffer overflow in the hdstrlcpy function in string.c via a crafted HTML document bsc1158802. - CVE-2021-20308: Fixed integer overflow in imageloadgif bsc1184424. - CVE-2022-0534: Fixed stack out-of-bounds rea...
This New Tool Can Retrieve Pixelated Text from Redacted Documents
The practice of blurring out text using a method called pixelation may not be as secure as previously thought. While the most foolproof way of concealing sensitive textual information is to use opaque black bars, other redaction methods like pixelation can achieve the opposite effect, enabling th...