CVE-2021-28093

OX Documents before 7.10.5-rev5 has an Incorrect Access Control of converted images due to hash collisions from Adler32. Root cause: Adler32-based hashing can collide, enabling access control bypass. Impact: partial confidentiality/integrity concerns with converted images; CVSS metrics indicate M...

CVE-2021-28093

OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32...

CVE-2021-28094

OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32...

CVE-2021-28094

OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents due to hash collisions from CRC32. Affected product: Open-Xchange OX Documents (pre-7.10.5-rev7). Root cause: CRC32-based hash collisions lead to improper access control. Impact: described as an access control is...

Apple iPadOS 竞争条件问题漏洞

iOS is a mobile operating system developed by Apple Inc. Apple macOS Big Sur is a mobile application app from Apple Inc. Apple iOS and macOS Big Sur are vulnerable to a competitive condition issue that could be exploited by attackers to open maliciously crafted PDF files resulting in unexpected...

NSO Group Hacked

NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware -- used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others -- was hacked. Or, at least, an enormous trove of documents was leaked to journalists. Theres a lo...

Open-xchange OX Documents 加密问题漏洞

Open-xchange OX Documents is an office software suite from the American company Open-xchange. The product supports the creation and editing of text documents, spreadsheets, presentations, and more. OX Documents suffers from an encryption issue vulnerability that arises from incorrect access contr...

Open-xchange OX Documents 加密问题漏洞

Open-xchange OX Documents is an office software suite from the American company Open-xchange. The product supports the creation and editing of text documents, spreadsheets, presentations, and more. Open-xchange OX Documents is vulnerable to an encryption issue that arises from a lack of...

Open-xchange OX Documents 加密问题漏洞

Open-xchange OX Documents is an office software suite from the American company Open-xchange. The product supports the creation and editing of text documents, spreadsheets, presentations, and more. OX Documents is vulnerable to a cryptographic issue that arises from a lack of authentication...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL...

[SECURITY] Fedora 34 Update: djvulibre-3.5.27-30.fc34

DjVu is a web-centric format and software platform for distributing documents and images. DjVu can advantageously replace PDF, PS, TIFF, JPEG, and GIF for distributing scanned documents, digital documents, or high-resolution picture s. DjVu content downloads faster, displays and renders faster,...

Lazarus Targets Job-Seeking Engineers with Malicious Documents

The notorious Lazarus advanced persistent threat APT group has been identified as the cybergang behind a campaign spreading malicious documents to job-seeking engineers. The ploy involves impersonating defense contractors seeking job candidates. Researchers have been tracking Lazarus activity for...

SideCopy Hackers Target Indian Government Officials With New Malware

A cyber-espionage group has been observed increasingly targeting Indian government personnel as part of a broad campaign to infect victims with as many as four new custom remote access trojans RATs, signaling a "boost in their development operations." Attributed to a group tracked as SideCopy, th...

Google for OpSec data discovery

Following last months post about what OpSec is and how it can benefit your company I wanted go a step further, and look at some of the ways you can super charge your searches to find interesting data about your company. Basic search parameters As I mentioned last month, one of the most useful too...

Vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to the writing beyond the buffer in memory, allowing attackers to execute arbitrary code.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to writing beyond the buffer boundaries in memory. Exploiting these vulnerabilities can allow a malicious actor to...

[SECURITY] Fedora 34 Update: pdfbox-2.0.24-1.fc34

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

[SECURITY] Fedora 33 Update: pdfbox-2.0.24-1.fc33

Apache PDFBox is an open source Java PDF library for working with PDF documents. This project allows creation of new PDF documents, manipulation of existing documents and the ability to extract content from documents. Apache PDFBox also includes several command line utilities. Apache PDFBox is...

Pakistan-linked hackers targeted Indian power company with ReverseRat

A threat actor with suspected ties to Pakistan has been striking government and energy organizations in the South and Central Asia regions to deploy a remote access trojan on compromised Windows systems, according to new research. "Most of the organizations that exhibited signs of compromise were...

XSS Vulnerability in Cyberdocuments (CNVD-2021-45738)

Ltd. formerly known as Anhui Zhongke Daxunfei Information Technology Co., Ltd, the company is headquartered in Hefei, was founded on December 30, 1999, and was changed to KD Xunfei Co., Ltd. on April 18, 2014, which specializes in intelligent voice and language technology research, software and...

Improper Input Validation

github.com/mongodb/mongo-go-driver is vulnerable to improper input validation. A remote attacker could use a Go object with a specifically crafted string, to inject additional fields into marshalled documents due to the insufficient validations in BSON marshalling functions...