CVE-2022-24820 Unauthenticated user can list hidden document from multiple velocity templates

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and...

CVE-2022-24820 Unauthenticated user can list hidden document from multiple velocity templates

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and...

CVE-2022-24820: Exposure of Private Personal Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and...

PT-2022-16900 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 12.10.11 XWiki Platform versions prior to 13.4.4 XWiki Platform versions prior to 13.9-rc-1 Description: A guest user without the right to view pages of the wiki can still list documents by rendering some...

XWiki Platform security vulnerabilities

Xwiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company Xwiki. A security vulnerability exists in XWiki Platform, which stems from the fact that a guest user who is not authorized to view a wiki page can still list documents related to the...

Xwiki Platform Access Control Vulnerability

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the XWiki Foundation in France. An access control error vulnerability exists in XWiki Platform, which stems from the fact that a guest user who does not have permission to view a wiki page can still list...

Multiple Hacker Groups Capitalizing on Ukraine Conflict for Distributing Malware

At least three different advanced persistent threat APT groups from across the world have launched spear-phishing campaigns in mid-March 2022 using the ongoing Russo-Ukrainian war as a lure to distribute malware and steal sensitive information. The campaigns, undertaken by El Machete, Lyceum, and...

diacamma-asso (>=2.0.1.16012810, <=2.1.16.17102513), diacamma-financial (>=2.0.1.16012810, <=2.1.15.17102513) +5 more potentially affected by CVE-2022-24303 via pillow (2.8.0)

pillow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - diacamma-asso =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.15101417, =2.0.1.15101417, =2.0.1.15101417, =0.1.2.1, =0.1.3 Source cves:...

Chinese 'Mustang Panda' Hackers Spotted Deploying New 'Hodur' Malware

A China-based advanced persistent threat APT known as Mustang Panda has been linked to an ongoing cyber espionage campaign using a previously undocumented variant of the PlugX remote access trojan on infected machines. Slovak cybersecurity firm ESET dubbed the new version Hodur, owing to its...

SUSE SLED15 / SLES15 Security Update : libreoffice (SUSE-SU-2022:0886-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0886-1 advisory. - LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no...

CVE-2021-45835

The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution...

CVE-2021-45835

The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution...

Russian threat actor UAC-0056 targets European countries

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. The Governmental Computer Emergency Response Team of Ukraine CERT-UA has released an alert about a Russian threat actor UAC-0056 SaintBear, UNC2589, TA471 delivering malwares using email attachments. UNC2589 is a cyber...

CVE-2021-46107

Ligeo Archives Ligeo Basics as of 0201-2022 is vulnerable to Server Side Request Forgery SSRF which allows an attacker to read any documents via the download features...

showdoc .properties file upload vulnerability (CNVD-2022-20508)

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could use this vulnerabilit...

Ligeo Archives Code Issues and Vulnerabilities

Ligeo Archives is an archive management software from the Ligeo Archives community in France. A security vulnerability exists in Ligeo Basics by Ligeo Archives, which stems from a server-side request forgery SSRF attack on Ligeo Basics. The vulnerability allows an attacker to read any document vi...

PT-2022-12569

Name of the Vulnerable Software and Affected Versions Ligeo Archives Ligeo Basics as of 02 01-2022 Description The issue allows an attacker to read any documents via the download features due to Server Side Request Forgery SSRF. This means an attacker can exploit the vulnerability to access...

Security update for libreoffice (moderate)

openSUSE Security Update: Security update for libreoffice Announcement ID: openSUSE-SU-2022:0886-1 Rating: moderate References: 1196456 SLE-18214 Cross-References: CVE-2021-25636 CVSS scores: CVE-2021-25636 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-25636 SUSE: 6.3...

Important: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution CVE-2022-25235 expat: Namespace-separator characters in "xmlns:prefix" attribute values can lead to arbitrary code execution CVE-2022-25236 expat:...

showdoc has unspecified vulnerabilities (CNVD-2022-20150)

showdoc is open source and a great tool for IT teams to share documents online. showdoc has a security vulnerability and no details of the vulnerability are currently available...