OPENSUSE-SU-2020:0677-1 Security update for file

This update for file fixes the following issues: Security issues fixed: - CVE-2019-18218: Fixed a heap-based buffer overflow in cdfreadpropertyinfo bsc1154661. Non-security issue fixed: - Fixed broken '--help' output bsc1169512. This update was imported from the SUSE:SLE-15:Update update project...

SUSE SLED15 / SLES15 Security Update : file (SUSE-SU-2020:1294-1)

This update for file fixes the following issues : Security issues fixed : CVE-2019-18218: Fixed a heap-based buffer overflow in cdfreadpropertyinfo bsc1154661. Non-security issue fixed : Fixed broken '--help' output bsc1169512. Note that Tenable Network Security has extracted the preceding...

SUSE-SU-2020:1294-1 Security update for file

This update for file fixes the following issues: Security issues fixed: - CVE-2019-18218: Fixed a heap-based buffer overflow in cdfreadpropertyinfo bsc1154661. Non-security issue fixed: - Fixed broken '--help' output bsc1169512...

CVE-2020-12685

XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript...

CVE-2020-12685

XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript...

CVE-2020-12685

Interchange 4.7.0–5.11.x contains an XSS flaw in the admin/help.html and admin/quicklinks.html pages that can enable remote attackers to steal credentials or data via browser JavaScript. The cited sources describe cross-site scripting in the admin UI as the vulnerability, but no remediation steps...

Gurbalib Path Traversal Vulnerability

Gurbalib is a lpmud mudlib game library for DGD drivers from the American software developer Kent Mein. A path traversal vulnerability exists in the lib/cmds/player/help.c file in Gurbalib versions 2020-04-30 and earlier. An attacker can exploit this vulnerability to read the management path...

CVE-2020-12649

Gurbalib through 2020-04-30 allows lib/cmds/player/help.c directory traversal for reading administrative paths...

rel.chubu-gu.ac.jp Open Redirect vulnerability

Open Bug Bounty ID: OBB-1146030 Security Researcher myNickName Helped patch 200 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting rel.chubu-gu.ac.jp website and its users. Following...

CISA Warns Patched Pulse Secure VPNs Could Still Expose Organizations to Hackers

The United States Cybersecurity and Infrastructure Security Agency CISA yesterday issued a fresh advisory alerting organizations to change all their Active Directory credentials as a defense against cyberattacks trying to leverage a known remote code execution RCE vulnerability in Pulse Secure VP...

The vulnerability of the chmd_read_headers() function in the Libmspack library allows a hacker to disclose protected information.

The vulnerability of the chmdreadheaders function libmspack/mspack/chmd.c in the Libmspack library arises from operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information through a specially created chm fil...

MS15-110: Description of the security update for Excel Services in SharePoint Server 2013: October 13, 2015

Resolves vulnerabilities in Office that could allow remote code execution if a user opens a specially crafted Office file.SummaryThis security update resolves vulnerabilities in Sharepoint. To learn more about these vulnerabilities, see Microsoft Security Bulletin MS15-110. Note To apply this...

MS15-110: Description of the security update for Office Web Apps Server 2013: October 13, 2015

Resolves vulnerabilities in Office that could allow remote code execution if a user opens a specially crafted Office file.SummaryThis security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To...

Cross-site Scripting (XSS)

eclipse-emf is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted Eclipse Help URL...

When You Should Blog and When You Should Tweet

I saw my like-minded, friend-that-I've-never-met Andrew Thompson Tweet a poll, posted above. I was about to reply with the following Tweet: "If I'm struggling to figure out how to capture a thought in just 1 Tweet, that's a sign that a blog post might be appropriate. I only use a thread, and no...

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal

Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Date: 2020-03-26 Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version: JReport 15.6 Tested on: Linux, Windows Jreport Help function...

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Date: 2020-03-26 Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version:...

Suddenly Teleworking, Securely

So you suddenly have a lot of staff working remotely. Telework is not new and a good percentage of the workforce already does so. But the companies who have a distributed workforce had time to plan for it, and to plan for it securely. A Lot of New Teleworkers All At Once This event can't be treat...

RedRabbit - Red Team PowerShell Script

RedRabbit is a PowerShell script aimed at helping pentesters conduct ethical hacking RedTeam To Run: You can either run locally by downloading the script or run remotely using: powershell –nop –c “iexNew-Object...

SQL injection vulnerability in the ne***_sh***.php page of the Handan Love Help You Do website building system

Handan Love Helps You Do is the first serious and professional marriage agency in Handan. SQL injection vulnerability exists in the nesh.php page of the Handan Love Help You Do website building system, which can be exploited by attackers to obtain sensitive information from the database...