Privilege Escalation

github.com/couchbase/syncgateway is vulnerable to privilege escalation. The vulnerability exists because of storage of bucket credentials in the metadata within sync documents written to the bucket, allowing a user with read privilege to perform write access to data in Couchbase Server. Note: Thi...

PT-2021-5520 · Adobe · Photoshop

Name of the Vulnerable Software and Affected Versions: Adobe Photoshop versions 23.0.2 and 22.5.4 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...

CVE-2021-27983

Remote Code Execution RCE vulnerability exists in MaxSite CMS v107.5 via the Documents page...

CVE-2021-27983

Remote Code Execution RCE vulnerability exists in MaxSite CMS v107.5 via the Documents page...

CVE-2021-27983

Remote Code Execution RCE vulnerability exists in MaxSite CMS v107.5 via the Documents page...

CVE-2021-27983

Remote Code Execution RCE vulnerability exists in MaxSite CMS v107.5 via the Documents page...

CVE-2021-27983

Remote Code Execution RCE vulnerability exists in MaxSite CMS v107.5 via the Documents page...

CVE-2021-27983

The CVE-2021-27983 entry concerns MaxSite CMS v107.5 where an input validation error on the Documents page enables Remote Code Execution (RCE). Multiple sources (CVE listings, CNVD, CNNVD, Red Hat advisory) corroborate: the vulnerability stems from insufficient input validation in the Documents p...

PT-2021-17701

Name of the Vulnerable Software and Affected Versions: MaxSite CMS version 107.5 Description: A Remote Code Execution RCE issue exists via the Documents page, allowing for potential code execution. Recommendations: For MaxSite CMS version 107.5, at the moment, there is no information about a newe...

MaxSite CMS has a vulnerability related to input validation.

MaxSite CMS is a Russian MaxSite CMS open source project a web content management system . An input validation error vulnerability exists in MaxSite CMS, which originates from the product's Documents page not validating input data. The vulnerability can be exploited to execute arbitrary code...

CVE-2021-27983: Undefined Security Weakness

Remote Code Execution RCE vulnerability exists in MaxSite CMS v107.5 via the Documents page...

CVE-2021-43963

An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. The bucket credentials used to read and write data in Couchbase Server were insecurely being stored in the metadata within sync documents written to the bucket. Users with read access could use these credentials to obtain writ...

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Description pimcore is vulnerable to Reflected XSS via the Search function for Document, Assets and Data Objects. Steps to reproduce 1.Login to pimcore admin. 2.In the left menu bar, click the Search icon then choose Documents, the Search Documents tab will display. 3.Input payload " into the...

Couchbase Sync Gateway information leakage vulnerability

Couchbase Sync Gateway is a secure web gateway for data access and data synchronization over the web from Couchbase, Inc. A security vulnerability exists in Couchbase Sync Gateway 2.7.0 through 2.8.2, which stems from the fact that the bucket credentials used to read and write data in Couchbase...

PT-2021-5954 · Pdftron · Pdftron

Name of the Vulnerable Software and Affected Versions: PDFTron versions prior to 9.0.7 Description: A Memory Corruption issue may lead to code execution through maliciously crafted DLL files. The vulnerability is related to errors in the mechanism for checking the path to dynamically loaded...

showdoc input validation error vulnerability

showdoc is an open source tool ideal for IT teams to share documents online. showDoc is vulnerable to an input validation error, which can be exploited by attackers to perform URL redirection attacks...

showdoc Cross-site Request Forgery Vulnerability (CNVD-2021-94821)

showdoc is an open source tool for IT teams to share documents online. showdoc is vulnerable to cross-site request forgery, which can be exploited by attackers via "/server/index.php?s=/api/itemGroup/save"...

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.

...

WIRTE Hacker Group Targets Government, Law, Financial Entities in Middle East

Government, diplomatic entities, military organizations, law firms, and financial institutions primarily located in the Middle East have been targeted as part of a stealthy malware campaign as early as 2019 by making use of malicious Microsoft Excel and Word documents. Russian cybersecurity compa...

ScarCruft surveilling North Korean defectors and human rights activists

The ScarCruft group also known as APT37 or Temp.Reaper is a nation-state sponsored APT actor we first reported in 2016. ScarCruft is known to target North Korean defectors, journalists who cover North Korea-related news and government organizations related to the Korean Peninsula, between others...