PT-2022-18280

Name of the Vulnerable Software and Affected Versions CVRF-CSAF-Converter versions prior to 1.0.0-rc2 Description The issue allows for the inclusion of arbitrary local file content into the generated output document due to XML External Entities XXE. This can be exploited by an attacker to disclos...

Threat advisory: Cybercriminals compromise users with malware disguised as pro-Ukraine cyber tools

Update March 12, 2022: Cisco Talos has updated the IOC section with additional hashes. Executive summary Opportunistic cybercriminals are attempting to exploit Ukrainian sympathizers by offering malware purporting to be offensive cyber tools to target Russian entities. Once downloaded, these...

Ransomware: February 2022 review

The Malwarebytes Threat Intelligence team continuously monitors the threat landscape to stay on top of existing and emerging attacks. In this February 2022 ransomware review, we go over some the most successful ransomware incidents based on both open source and dark web intelligence. BlackByte...

OverIT Geocall 代码问题漏洞

OverIT Geocall is a field service management solution from OverIT Italy. A code issue vulnerability exists in OverIT Geocall prior to version 8.0, which originates from an XXE vulnerability that can be exploited by an authenticated user with the Test Trasformazione XSL feature enabled to read...

Weekly Threat Digest: 28 February – 6 March 2022

For a detailed threat digest, download the pdf file here Published Vulnerabilities Interesting Vulnerabilities Targeted Countries Targeted Industries ATT&CK TTPs 381 19 3 5 22 The first week of March 2022 witnessed the discovery of 381 vulnerabilities out of which 19 garnered the attention of...

Hazelcast 代码问题漏洞

Hazelcast Hazelcast IMDG is a scalable open-source data distribution platform from Hazelcast, Inc. The platform supports a variety of distributed data structures, distributed caching and other features. Hazelcast versions prior to 5.1 of XML has a code problem vulnerability, which stems from not...

Hackers Try to Target European Officials to Get Info on Ukrainian Refugees, Supplies

Details of a new nation-state sponsored phishing campaign have been uncovered setting its sights on European governmental entities in what's seen as an attempt to obtain intelligence on refugee and supply movement in the region. Enterprise security company Proofpoint, which detected the malicious...

GHSA-H2FG-54X9-5QHQ Nil dereference in NATS JWT, DoS of nats-server

Problem Description The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account. The Operator should be able to safely issue Accounts to other entities which it does not fully trust. A malicious Account...

Remote Code Execution

@joplin/renderer is vulnerable to remote code execution. The vulnerability exists in stripHtml function of htmlUtils.ts because the html entities are not encoded which allows an attacker to inject and execute malicious codes...

Hackers Exploited 0-Day Vulnerability in Zimbra Email Platform to Spy on Users

A threat actor, likely Chinese in origin, is actively attempting to exploit a zero-day vulnerability in the Zimbra open-source email platform as part of spear-phishing campaigns that commenced in December 2021. The espionage operation — codenamed "EmailThief" — was detailed by cybersecurity compa...

Foxit PDF Editor < 11.2.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 11.2.1. It is, therefore affected by multiple vulnerabilities: - Acrobat Reader DC version 21.007.20099 and earlier, 20.004.30017 and earlier and...

Sql injection

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the Entities update right prevents exploitation...

UBUNTU-CVE-2022-21720

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the Entities update right prevents exploitation...

Mageia: Security Advisory (MGASA-2015-0138)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-1462 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 9.5.7 Description: The issue is related to a lack of protection against SQL query structure exploitation, allowing a remote attacker to execute arbitrary SQL queries. An entity administrator can retrieve normally...

How to disable XXE processing?

In my last post I talked about XXE vulnerabilities found on popular open-source projects and more generally how to assess this type of issue. Today, I’ll talk about the different strategies to disable XXE processing. External XXE and internal entities are useful for building concise XML documents...

Server side request forgery (ssrf)

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

CVE-2021-41809 SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

M-Files Server 代码问题漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server products prior to version 22.1.11017.1, which stems from a preview feature that allows querying from the server for certain document types that reference external entities...

CVE-2021-41809

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...