Zoom clarifies user consent requirement when training its AI

Changes in the terms of service TOS of the Zoom video-conferencing software have caused some turmoil. Since the pandemic, Zoom Video Conferencing has become a household name. Zoom came up as the big winner in the video conferencing struggle that enabled us to work from home. Now that things are...

CVE-2023-39342

CVE-2023-39342 affects Dangerzone CLI (dangerzone-cli) prior to 0.4.2. The issue arises because the CLI logs container-output from the sanitization process to the user’s terminal and also logs file names; if the container is compromised, an attacker could return attacker-controlled strings to spo...

PT-2023-4641 · Adobe · Acrobat Document Cloud +2

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 23.003.20244 and earlier Adobe Acrobat Reader versions 20.005.30467 and earlier Adobe Acrobat 2020 Adobe Acrobat Document Cloud Description: The issue is related to a Use After Free vulnerability, which could...

thunderbird: File Extension Spoofing using the Text Direction Override Character

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

Authorization Bypass

firefox is vulnerable to Authorization Bypasses. A flaw was found in the way that documents loaded principal objects. This flaw could have allowed a malicious user to load a document with a higher privilege level than they should have been allowed...

USN-6273-1 poppler vulnerabilities

Jieyong Ma discovered that poppler incorrectly handled certain malformed PDF files. A remote attacker could possibly use this issue to cause poppler to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. CVE-2022-27337 It was discovered that...

PT-2023-26582 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 8.0.0 through 8.8.15 Patch 40 Zimbra Collaboration ZCS versions 9.0.0 through 9.0.0 Patch 33 Zimbra Collaboration ZCS versions 10.0.0 through 10.0.1 Description: Internal JSP and XML files can be exposed in...

SiegedSec Hacktivist Claims to Strike NATO and Leak Sensitive Docs

By Waqas The hackers have leaked almost 1 GB worth of data, which contains documents, presentations, and contact details of over 70 NATO officials. This is a post from HackRead.com Read the original post: SiegedSec Hacktivist Claims to Strike NATO and Leak Sensitive Docs...

Pimcore cross-site scripting vulnerabilities

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site scripting vulnerability exists in...

libqpdf QPDWriter Command Injection

The vulnerability of the libqpdf/QPDWriter.cc command-line utility for converting PDF documents is related to an uncontrolled recursion. Exploiting this vulnerability allows a malicious actor to cause service interruptions by using a specially created PDF file...

CVE-2023-28744

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF document can trigger the reuse of previously freed memory by manipulating form fields of a specific type. This can lead to memory corruption and arbitrary...

Foxit Reader Resource Management Vulnerability

Foxit Reader is a Chinese Foxit Foxit company's a PDF document reader. A resource management error vulnerability exists in Foxit Reader version 12.1.1.15289, which originates when a specially crafted PDF document can trigger the reuse of previously freed memory by manipulating certain types of fo...

PT-2023-25984 · Knowage · Knowage

Name of the Vulnerable Software and Affected Versions: Knowage versions prior to 8.1.8 Description: Knowage is an open source suite for business analytics that uses user-supplied data to create HQL queries without prior sanitization. An attacker can create specially crafted HQL queries to break...

SEO Expert Hired and Fired By Ashley Madison Turned on Company, Promising Revenge

This is Part II of a story published here last week on reporting that went into a new Hulu documentary series on the 2015 Ashley Madison hack. It was around 9 p.m. on Sunday, July 19, when I received a message through the contact form on KrebsOnSecurity.com that the marital infidelity website...

PicassoLoader Malware Used in Ongoing Attacks on Ukraine and Poland

Government entities, military organizations, and civilian users in Ukraine and Poland have been targeted as part of a series of campaigns designed to steal sensitive data and gain persistent remote access to the infected systems. The intrusion set, which stretches from April 2022 to July 2023,...

Windows Code Execution

Vulnerabilities of Windows operating systems and Microsoft Office software are related to errors in processing input data. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code by having the user open a specially crafted Microsoft Office document...

Storm-0978 attacks reveal financial and espionage motives

Microsoft has identified a phishing campaign conducted by the threat actor tracked as Storm-0978 targeting defense and government entities in Europe and North America. The campaign involved the abuse of CVE-2023-36884, which included a remote code execution vulnerability exploited before disclosu...

PT-2023-3474

Name of the Vulnerable Software and Affected Versions Microsoft Office and Windows versions affected versions not specified Description This issue is a remote code execution vulnerability affecting Microsoft Office and Windows systems. It stems from flaws in how input data is processed,...

RomCom RAT Targeting NATO and Ukraine Support Groups

The threat actors behind the RomCom RAT have been suspected of phishing attacks targeting the upcoming NATO Summit in Vilnius as well as an identified organization supporting Ukraine abroad. The findings come from the BlackBerry Threat Research and Intelligence team, which found two malicious...

LibreOffice File System Access

The vulnerability of the LibreOffice office software package is related to insufficient testing of server-side requests. Exploiting this vulnerability could allow a malicious actor to gain access to the file system using specially crafted ODT files...