GE Employees Lit Up with Sensitive Doc Breach

A phisher’s treasure chest of personally identifiable information PII for General Electric employees has been exposed – thanks to the compromise of one of the company’s partners, Canon Business Process Services. In a data-breach notice filed with the State of California, General Electric GE noted...

CVE-2020-10669

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

Authentication flaw

The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the late...

CVE-2019-16338

The tfocommon component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file...

Design/Logic Flaw

LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users,...

Media Foundation Component Access Modification

The vulnerability of the Media Foundation component in Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to gain access to, modify, or delete data through a specially created document or a specially created web pag...

Graphics Device Interface GDI Privilege Escalation

The vulnerability of the Graphics Device Interface GDI component in Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to gain full control over the system or execute arbitrary code using a specially created documen...

Graphics Device Interface Unauthorized Access

The vulnerability of the Graphics Device Interface GDI component in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created document or a...

Graphics Device Interface Unauthorized Access

The vulnerability of the Graphics Device Interface GDI component in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information through a specially...

Exploit for Use After Free in Microsoft

sectoolset -- Github安全相关工具集合 主要内容： 0x00 漏洞利用实战练习&CTF安全竞赛 0x01 安全扫描器 0x02 安全防守 0x03 渗透测试 0x04 漏洞库及利用工具（POC，EXP 0x05 二进制及代码分析工具 0x06 威胁情报&蜜罐 0x07 安全文档资料 0x11 所有内容 乌云镜像 乌云镜像 乌云镜像,河蟹 近期安全热点 facebook又爆出大量数亿用户隐私数据泄露 CVE-2019-14378 QEMU VM Escape严重漏洞，影响KVM等QEMU为后端的虚拟平台 CVE-2019-10173 Xstream 远程代码执行漏洞...

CVE-2019-19210

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

CVE-2019-19210: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

WAGO PFC 200 Data Forgery Problem Vulnerability

The WAGO PFC 200 is a programmable logic controller PLC from the German company WAGO. A remote code execution vulnerability exists in the cloud connectivity feature of the WAGO PFC 200 using firmware versions 03.02.0214, 03.01.0713, and 03.00.3912. The vulnerability can be exploited by an attacke...

XSSFExportToXml Unauthorized Access

The vulnerability in the XSSFExportToXml Java library for reading and writing MS Office documents using Apache POI is related to deficiencies in the restriction on XML references to external objects. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read the fil...

More on Crypto AG

One follow-on to the story of Crypto AG being owned by the CIA: this interview with a Washington Post reporter. The whole thing is worth reading or listening to, but I was struck by these two quotes at the end: ...in South America, for instance, many of the governments that were using Crypto...

CVE-2020-8778

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via an uploaded document, when the attacker has write access to a project...

Google Chrome Information Disclosure Vulnerability (CNVD-2020-14821)

Google Chrome is a web browser from Google, an American company. An information disclosure vulnerability exists in Google Chrome versions prior to 3.0, which stems from the program's failure to properly process XML documents. A remote attacker could exploit the vulnerability to obtain sensitive...

Debian DLA-2112-1 : python-reportlab security update

It was found that ReportLab, a Python library to create PDF documents, did not properly parse color strings, allowing an attacker to execute arbitrary code through a crafted input document. For Debian 8 'Jessie', this problem has been fixed in version 3.1.8-3+deb8u2. We recommend that you upgrade...

Debian: Security Advisory (DLA-2112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2112-1] python-reportlab security update

Package : python-reportlab Version : 3.1.8-3+deb8u2 CVE ID : CVE-2019-17626 Debian Bug : 942763 It was found that ReportLab, a Python library to create PDF documents, did not properly parse color strings, allowing an attacker to execute arbitrary code through a crafted input document. For Debian ...