January 5, 2021, update for Project 2016 (KB4493159)

None None...

Code injection

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

The new Wondershare PDFelement with added features

By Sudais Asif PDFelement is an all-in-one PDF solution allowing users to edit, convert, and optimise documents securely. Here's how it works. This is a post from HackRead.com Read the original post: The new Wondershare PDFelement with added features...

CVE-2020-29254

TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the...

Tiki Wiki Cross-Site Request Forgery Vulnerability

Tiki Wiki is a Php-based wiki system for the Tiki community. A security vulnerability exists in Tiki Wiki 21.2 that allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to exploit the vulnerability to perform a cross-site request forgery CSRF...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to writing beyond the buffer in memory. This allows attackers to execute arbitrary code.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are related to writing beyond the buffer limit in memory. Exploiting these vulnerabilities can allow a malicious actor to execut...

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are due to the “race-to-privilege” scenario, which allows a malicious actor to escalate their privileges.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are due to a “race-to-the-bottom” scenario. Exploiting these vulnerabilities can allow an attacker to enhance their privileges...

ChurchCRM 4.2.0 CSV Injection

Exploit Title: ChurchCRM 4.2.1- CSV/Formula Injection Date: 2020- 10- 24 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.0 Payload: =10+20+cmd|' /C calc'!A0 Tested on: Kali Linux 2020.3 Proof Of Concept: CSV...

OPENSUSE-SU-2020:2057-1 Security update for ceph

This update for ceph fixes the following issues: - CVE-2020-25660: Bring back CEPHXV2 authorizer challenges bsc1177843. - Major batch refactor of ceph-volume that addresses a couple of issues bsc1151612, bsc1158257 - Documented Prometheus' security model bsc1169134 - monclient: Fixed an issue whe...

XSS Vulnerability in the Collaborative Journal Acquisition and Editing System of China Academic Journals (CD-ROM Version) Electronic Magazine Agency Ltd.

The collaborative editorial system of periodicals is a comprehensive service platform for the whole process of periodicals collection, editing, reviewing, proofreading and distribution. An XSS vulnerability exists in the collaborative journal collection and editing system of China Academic Journa...

Dundas BI server cross-site scripting vulnerability

Dundas BI server is a web-based server application. A cross-site scripting vulnerability exists in Dundas BI version 8.0.0.1001 and prior versions, which stems from allowing XSS attacks via HTML tags when creating or editing dashboards. No detailed vulnerability details are currently available...

Cross site scripting

The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard...

CVE-2020-27977

CapaSystems CapaInstaller (Windows) versions before 6.0.101 are affected by an elevation of privileges flaw caused by improper assignment/modification/check of privileges when editing registry values. This allows a local attacker to escalate privileges. Remediation: upgrade to version 6.0.101 or ...

Lark Technologies: Accessing/Editing Folders of Other Users in the Orginisation.

A vulnerability was found where users without Primary admin privileges were able to view/modify the directory structure of other users in their organization. This would occur after those users were invited to view/modify their folders by a Primary admin. We thank @snapsec for reporting this to ou...

CVE-2020-26211

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a pag...

[20210307] - Core - ACL violation within com_content frontend editing

Incorrect ACL checks could allow unauthorized change of the category for an article...

[SECURITY] Fedora 32 Update: nextcloud-18.0.9-1.fc32

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing r ight on the web. NextCloud is extendable via a simple but powerful API...

CAD Quick Look - Editing Assistant pc client software has a command execution vulnerability

Quanta Technology Co., Ltd. is a listed software company, based on the field of construction engineering, centering on the whole life cycle of engineering projects, providing professional applications in the field of construction engineering as the core basic support, and value-added services suc...

Cross site scripting

An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references...

CVE-2020-13338

CVE-2020-13338 affects GitLab versions prior to 12.10.13, 13.0.8, and 13.1.2. The issue is a stored cross-site scripting vulnerability when editing references. The connected documents confirm the affected versions and the nature of the vulnerability but do not provide explicit remediation steps o...