CVE-2023-6341 Catalis CM360 allows authentication bypass

Catalis previously Icon Software CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies based on the intention and configuration of a specific CMS360 installation...

CVE-2023-6341

Catalis CMS360 (Catalis, formerly Icon Software) contains a vulnerability that allows an unauthenticated, remote attacker to view sensitive court documents by modifying document and other identifiers in URLs. The impact varies with the installation’s configuration and intended use. This CVE is do...

New SugarGh0st RAT targets Uzbekistan government and South Korea

Cisco Talos recently discovered a malicious campaign that likely started as early as August 2023, delivering a new remote access trojan RAT we dubbed "SugarGh0st." We found evidence suggesting the threat actor is targeting the Uzbekistan Ministry of Foreign Affairs and users in South Korea. We...

Multiple Vulnerabilities Affecting Web-Based Court Case and Document Management Systems

CISA has assisted a researcher with coordinating the disclosure of multiple researcher-discovered vulnerabilities affecting web-based case and document management systems used by multiple state, county, and municipal courts. Affected systems include products from Tyler Technologies and Catalis an...

Henschen & Associates court document management software Security Feature Issue Vulnerability

Henschen & Associates court document management software is a court document management software from Henschen & Associates. A security vulnerability exists in Henschen & Associates court document management software, which arises from insufficient randomization of the filenames of cached...

USN-6508-2 poppler regression

USN-6508-1 fixed vulnerabilities in poppler. The update introduced one minor regression in Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that poppler incorrectly handled certain malformed PDF files. If a user or a...

CVE-2023-47251

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers with access to a VNC session to automatically transfer malicious PDF documents by moving them into the .spool directory, and then...

CVE-2023-47251

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers with access to a VNC session to automatically transfer malicious PDF documents by moving them into the .spool directory, and then...

CVE-2023-47251

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers with access to a VNC session to automatically transfer malicious PDF documents by moving them into the .spool directory, and then...

DOMSanitizer Security Vulnerability

DOMSanitizer is a DOM Document Object Model security operation or filter by Andy Miller, a personal developer. A security vulnerability exists in versions of DOMSanitizer prior to 1.0.7 that stems from mishandling of annotations and greedy regular expressions, allowing cross-site scripting XSS...

CVE-2023-47251

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attackers with access to a VNC session to automatically transfer malicious PDF documents by moving them into the .spool directory, and then...

CVE-2023-47251

CVE-2023-47251 affects mprivacy-tools before 2.0.406g (TightGate-Pro Server). A Directory Traversal in the VNC print function allows authenticated users with a VNC session to place malicious PDFs into the .spool directory and trigger the VNC service to transfer them to the connected VNC client’s ...

The vulnerability of the PUB Manager web-based system for managing technological processes in SIMATIC PCS neo allows a hacker to load arbitrary documents.

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow an attacker to download arbitrary documents remotely...

m-privacy TightGate-Pro Server Security Vulnerability

The m-privacy TightGate-Pro Server is a remote control browser system from the German company m-privacy. A security vulnerability exists in m-privacy TightGate-Pro Server versions prior to 2.0.406g, which originated from a vulnerability that allows an authenticated attacker to automatically...

Secretive White House Surveillance Program Gives Cops Access to Trillions of US Phone Records

A WIRED analysis of leaked police documents verifies that a secretive government program is allowing federal, state, and local law enforcement to access phone records of Americans who are not suspected of a crime...

CVE-2023-48241

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wiki...

XWiki Platform Security Vulnerability

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in Xwiki versions 6.3-milestone-2 through 14.10.15 and 15.0-rc-1 through 15.5.1, which stems from disclosing the content of all documents to...

Oracle Linux 9 : ghostscript (ELSA-2023-6732)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6732 advisory. - fix for CVE-2023-43115 - fix for CVE-2023-38559 - fix for CVE-2023-36664 Tenable has extracted the preceding description block directly from the Oracle Linux...

Siemens SIMATIC PCS neo Authentication Error Vulnerability

SIMATIC PCS neo is a distributed control system DCS. An authentication error vulnerability exists in Siemens SIMATIC PCS neo, which can be exploited by an attacker to generate a privileged token and upload additional documents...

libreoffice: Remote documents loaded without prompt via IFrame

A vulnerability was found in LibreOffice. Improper access control in the editor components of The Document Foundation in LibreOffice allows an attacker to craft a document that causes external links to load without a prompt. In the affected versions of LibreOffice documents that used "floating...