PT-2021-14417

Name of the Vulnerable Software and Affected Versions matrix-react-sdk versions prior to 3.15.0 Description The user content sandbox in matrix-react-sdk can be abused to trick users into opening unexpected documents. This is achieved through several user interactions, allowing the content to be...

CVE-2021-21320: Insufficient Verification of Data Authenticity

matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a blob origin that cannot access Matrix user data, so...

matrix-react-sdk 数据伪造问题漏洞

Travis Ralston matrix-react-sdk is an open source application by Travis Ralston. It is used to insert the Matrix chat/voice client into web pages. A security vulnerability exists in matrix-react-sdk before version 3.15.0, which stems from the possibility that user content sandboxing could be abus...

Elasticsearch 信息泄露漏洞

Elasticsearch is the Netherlands Elasticsearch company's set of open source distributed RESTful search engine built on Lucene . The product is primarily used in cloud computing and supports data indexing using JSON over HTTP.Security is one of the data protection components. Elasticsearch There i...

LazyScripter: From Empire to double RAT

Malwarebytes’ Threat Intelligence analysts are continually researching and monitoring active malware campaigns and actor groups as the prevalence and sophistication of targeted attacks rapidly evolves. In this paper, we introduce a new APT group we have named LazyScripter, presenting in-depth...

Experts Warns of Notable Increase in QuickBooks Data Files Theft Attacks

New research has uncovered a significant increase in QuickBooks file data theft using social engineering tricks to deliver malware and exploit the accounting software. "A majority of the time, the attack involves basic malware that is often signed, making it hard to detect using antivirus or othe...

CVE-2021-22645

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll fro...

CVE-2021-22645

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll fro...

CVE-2021-22645

Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are vulnerable to an attack because the .bip documents display a “load” command, which can be pointed to a .dll fro...

CVE-2021-22645

CVE-2021-22645 affects Luxion KeyShot family prior to 10.1, specifically KeyShot, KeyShot Viewer, KeyShot Network Rendering, and KeyVR. The vulnerability arises from .bip documents displaying a “load” command that can reference a remote DLL, allowing the DLL entry point to execute without suffici...

Court docs show FBI can unlock iPhones, access Signal messages

By Waqas Court documents have revealed the FBI has specific tools that allow the bureau to access private Signal messages even on locked iPhones. This is a post from HackRead.com Read the original post: Court docs show FBI can unlock iPhones, access Signal messages...

Medieval Security Techniques

Sonja Drummer describes with photographs two medieval security techniques. The first is a for authentication: a document has been cut in half with an irregular pattern, so that the two halves can be brought together to prove authenticity. The second is for integrity: hashed lines written above an...

CVE-2021-21062

Acrobat Reader DC versions versions 2020.013.20074 and earlier, 2020.001.30018 and earlier and 2017.011.30188 and earlier are affected by a Memory corruption vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary...

CVE-2021-21057

Acrobat Reader DC versions versions 2020.013.20074 and earlier, 2020.001.30018 and earlier and 2017.011.30188 and earlier are affected by a null pointer dereference vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to achieve...

Generation of fake documents via public GET-call

Impact Generation of fake documents via public GET-call Patches We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older...

GHSA-JVG4-9RC2-WVCR Generation of fake documents via public GET-call

Impact Generation of fake documents via public GET-call Patches We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older...

PT-2021-24440

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 6.3.5.1 Description: The issue allows for the generation of fake documents via a public GET call. There is no information provided about the estimated number of potentially affected devices worldwide or details abou...

UBUNTU-CVE-2021-26221

The ezxmlnew function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool...

PT-2021-11344 · Softmaker · Softmaker Office Planmaker 2021

Name of the Vulnerable Software and Affected Versions: SoftMaker Office PlanMaker 2021 Revision 1014 Description: A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used fo...

PT-2021-2169

Name of the Vulnerable Software and Affected Versions Luxion KeyShot versions prior to 10.1 Luxion KeyShot Viewer versions prior to 10.1 Luxion KeyShot Network Rendering versions prior to 10.1 Luxion KeyVR versions prior to 10.1 Description The issue is related to insufficient warning about...