FreeBSD : couchdb -- information sharing via couchjs processes (fd47fcfe-ec69-4000-b9ce-e5e62102c1c7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fd47fcfe-ec69-4000-b9ce-e5e62102c1c7 advisory. - Design documents with matching document IDs, from databases on the same cluster, may share a mutable...

New Pierogi++ Malware by Gaza Cyber Gang Targeting Palestinian Entities

A pro-Hamas threat actor known as Gaza Cyber Gang is targeting Palestinian entities using an updated version of a backdoor dubbed Pierogi. The findings come from SentinelOne, which has given the malware the name Pierogi++ owing to the fact that it's implemented in the C++ programming language...

SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2023-100007)

SAP Business Objects is a business intelligence suite from SAP, Germany. A cross-site scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform 420 version 430, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be...

UBUNTU-CVE-2023-45725

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...

CVE-2023-45725 Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: list show rewrite update An attacker can leak the session component using an HTML-like output,...

CVE-2023-49923

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...

CVE-2023-49923

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...

CVE-2023-49923

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...

CVE-2023-49923

Elastic App Search’s Documents API logged raw indexed document contents at INFO, risking leakage of sensitive data in logs. Affected versions: Enterprise Search/App Search before 7.17.16 and before 8.11.2. Root cause: logging those contents at INFO; fix: log at DEBUG (disabled by default) in 7.17...

Enterprise Search 8.11.2 / 7.17.16 Security Update (ESA-2023-31)

Enterprise Search Insertion of Sensitive Information into Log File ESA-2023-31 An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion o...

Russian APT28 Hackers Targeting 13 Nations in Ongoing Cyber Espionage Campaign

The Russian nation-state threat actor known as APT28 has been observed making use of lures related to the ongoing Israel-Hamas war to facilitate the delivery of a custom backdoor called HeadLace. IBM X-Force is tracking the adversary under the name ITG05, which is also known as BlueDelta, Fancy...

CVE-2023-42478

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application...

CVE-2023-42478

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application...

CVE-2023-42478 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application...

PT-2023-31412 · Elastic · App Search

Name of the Vulnerable Software and Affected Versions: Elastic App Search versions prior to 7.17.16 Elastic App Search versions prior to 8.11.2 Description: An issue was discovered in the Documents API of App Search where it logged the raw contents of indexed documents at INFO log level. This cou...

Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2023-3297)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2023-3329)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Elastic Enterprise Search Log Information Disclosure Vulnerability

Elastic Enterprise Search is an enterprise search tool from Dutch company Elastic. A security vulnerability exists in Elastic Enterprise Search versions 7.0.0 through 7.17.16 and 8.0.0 through 8.11.2, which stems from App Search's Documents API recording the original content of indexed documents ...

CVE-2023-49923: Insertion of Sensitive Information into Log File

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...

LibreOffice Code Execution

The vulnerability of the LibreOffice office software package relates to the possibility of introducing code or data into the system. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by embedding a malicious macro into documents from a remote location...