CVE-2023-28118 kaml has potential denial of service while parsing input with anchors and aliases

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and...

GHSA-RRWM-8WQM-GWGV Cross-site Scripting (XSS) - stored in Print Documents

Impact Stored xss leads to steal cookies and other information of other users Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14560.patch Workarounds Apply https://github.com/pimcore/pimcore/pull/14560.patch manually. References...

Cross-site Scripting (XSS) - stored in Print Documents

Impact Stored xss leads to steal cookies and other information of other users Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14560.patch Workarounds Apply https://github.com/pimcore/pimcore/pull/14560.patch manually. References...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform (etcd) security update

An update for etcd is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

YoroTrooper Stealing Credentials and Information from Government and Energy Organizations

A previously undocumented threat actor dubbed YoroTrooper has been targeting government, energy, and international organizations across Europe as part of a cyber espionage campaign that has been active since at least June 2022. "Information stolen from successful compromises include credentials...

SUSE CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

Description of the security update for SharePoint Server 2019: March 14, 2023 (KB5002358)

None None...

Emotet Returns, Now Adopts Binary Padding for Evasion

Following a three-month hiatus, Emotet spam activities resumed in March 2023, when a botnet known as Epoch 4 began delivering malicious documents embedded in Zip files that were attached to the emails...

Get integrated Microsoft Purview Information Protection in Adobe Acrobat—now available

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. Data security and compliance are a top priority for leaders as cyberattacks are on the rise. In fact, attacks have increased by 32 percent in the past year, and 1 in 40 organizations...

GHSA-97CP-8873-V2GF Pimcore vulnerable to Cross Site Scripting in Documents Link Editable

Impact An attacker can use XSS to send a malicious script to any user through Document Page Link Editable - Advanced - Attributes Patches Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14500.patch Workarounds Apply...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (etcd) security update

An update for etcd is now available for Red Hat OpenStack Platform 17.0 Wallaby. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Cybercrime Takes Advantage of 2023-Recession with Job-Themed Scams

Cybercrime Takes Advantage of 2023 Recession with Job-Themed Scams By Daksh Kapur · February 28, 2023 Figure 1 image from freepik.com and flaticon.com The current economic climate globally is grim because of the ongoing recession. In this environment, job-themed emails have become a prime target...

[SECURITY] Fedora 37 Update: plasma-vault-5.27.1-1.fc37

Plasma Vault allows to lock and encrypt sets of documents and hide them from prying eyes even when the user is logged in...

GHSA-3X49-G6RC-C284 LiteDB may deserialize bad JSON on object type using _type

Impact LiteDB use a special field in JSON documents to cast diferent types from BsonDocument do POCO classes. When instance of an object are not the same of class, BsonMapper use a special field type string info with full class name with assembly to be loaded and fit in your model. If your end-us...

XSS in button home page

Description vuln was find in File/Documents/Home , any button in page Proof of Concept 1. Login in URL : https://demo.pimcore.fun/admin 2. Go to File - Open Documents - Home 3. click any button in page - Edit Link 4. in tab Advanced, inject payload to : Attributes key="value" For more understandi...

K54225343: libxml2 vulnerabilities CVE-2016-3627 and CVE-2016-3705

Security Advisory Description CVE-2016-3627 The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service infinite recursion, stack consumption, and application crash via a crafted XML document...

Adobe FrameMaker out-of-bounds write vulnerability (CNVD-2023-14297)

Adobe Framemaker is a set of page layout software for writing and editing large or complex documents including structured documents from Adobe. Adobe FrameMaker has an out-of-bounds write vulnerability that can be exploited by attackers to cause arbitrary code execution...

CVE-2022-39954

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5,...

CVE-2022-39954

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5,...

SUSE CVE-2003-1564

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, aka the "billion laughs...