Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2023-3297)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ghostscript (EulerOS-SA-2023-3329)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Elastic Enterprise Search Log Information Disclosure Vulnerability

Elastic Enterprise Search is an enterprise search tool from Dutch company Elastic. A security vulnerability exists in Elastic Enterprise Search versions 7.0.0 through 7.17.16 and 8.0.0 through 8.11.2, which stems from App Search's Documents API recording the original content of indexed documents ...

CVE-2023-49923: Insertion of Sensitive Information into Log File

An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...

LibreOffice Code Execution

The vulnerability of the LibreOffice office software package relates to the possibility of introducing code or data into the system. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by embedding a malicious macro into documents from a remote location...

PT-2023-29658 · Ibm +1 · Ibm Cloudant +1

Name of the Vulnerable Software and Affected Versions: Apache CouchDB versions prior to 3.3.3 IBM Cloudant versions prior to 8413 Description: Design document functions that receive a user HTTP request object may expose authorization or session cookie headers of the user who accesses the document...

Chinese Hackers Using SugarGh0st RAT to Target South Korea and Uzbekistan

A suspected Chinese-speaking threat actor has been attributed to a malicious campaign that targets the Uzbekistan Ministry of Foreign Affairs and South Korean users with a remote access trojan called SugarGh0st RAT. The activity, which commenced no later than August 2023, leverages two different...

CVE-2023-6376

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

CVE-2023-6341

Catalis previously Icon Software CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation...

Design/Logic Flaw

Catalis previously Icon Software CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation...

Design/Logic Flaw

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

CVE-2023-6341 Catalis CM360 allows authentication bypass

Catalis previously Icon Software CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation...

CVE-2023-6341

Catalis CMS360 (Catalis, formerly Icon Software) contains a vulnerability that allows an unauthenticated, remote attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies with the installation’s configuration and intended use. This CVE is do...

New SugarGh0st RAT targets Uzbekistan government and South Korea

Cisco Talos recently discovered a malicious campaign that likely started as early as August 2023, delivering a new remote access trojan RAT we dubbed "SugarGh0st." We found evidence suggesting the threat actor is targeting the Uzbekistan Ministry of Foreign Affairs and users in South Korea. We...

Multiple Vulnerabilities Affecting Web-Based Court Case and Document Management Systems

CISA has assisted a researcher with coordinating the disclosure of multiple researcher-discovered vulnerabilities affecting web-based case and document management systems used by multiple state, county, and municipal courts. Affected systems include products from Tyler Technologies and Catalis an...

Henschen & Associates court document management software Security Feature Issue Vulnerability

Henschen & Associates court document management software is a court document management software from Henschen & Associates. A security vulnerability exists in Henschen & Associates court document management software, which arises from insufficient randomization of the filenames of cached...

CVE-2023-6376: Use of Insufficiently Random Values

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

PT-2023-32633

Name of the Vulnerable Software and Affected Versions Henschen & Associates court document management software affected versions not specified Description The issue arises from insufficient randomization of file names of cached documents, allowing a remote, unauthenticated attacker to access...

USN-6508-2 poppler regression

USN-6508-1 fixed vulnerabilities in poppler. The update introduced one minor regression in Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or a...

CVE-2023-47251

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers with access to a VNC session to automatically transfer malicious PDF documents by moving them into the .spool directory, and then...