17647 matches found
CVE-2021-21137
CVE-2021-21137 concerns an incorrect calculation issue in the DevTools component of Chromium prior to 88.0.4324.96. The core vulnerability is an inappropriate implementation in DevTools that could allow a remote attacker to obtain potentially sensitive information from disk via a crafted HTML pag...
Microsoft SharePoint Remote Code Execution Vulnerability
...
GitLab: Kroki Arbitrary File Read/Write
Summary In short, I've found a potentially weird bug in asciidoctor that could lead to arbitrary file read/write in asciidoctor-kroki even though Gitlab have already made an attempt to disable kroki-plantuml-include lib/gitlab/asciidoc.rb rb module Gitlab Parser/renderer for the AsciiDoc format...
Code injection
Article Bcc fields and agent personal information are shown when customer prints the ticket PDF via external interface. This issue affects: OTRS AG OTRS 7.0.x version 7.0.23 and prior versions; 8.0.x version 8.0.10 and prior versions...
CVE-2021-21434
CVE-2021-21434 is described across multiple sources as a cross-site scripting/code injection issue in the OTRS AG Survey product. The vulnerability allows a malicious survey to cause code execution in the agent interface, affecting OTRS AG Survey 6.0.x (6.0.20 and prior) and 7.0.x (7.0.19 and pri...
CVE-2021-21435
CVE-2021-21435 affects OTRS AG OTRS 7.0.x up to 7.0.23 and 8.0.x up to 8.0.10. The issue: when printing a ticket (PDF) via an external interface, Article Bcc fields and agent personal information are exposed. The Initial Description provides CVSS v2/v3.1 scores (base 4.3/6.5) and a reference to O...
Digital Publications by Supsystic < 1.6.12 - Authenticated Path Traversal
The "Folder" tab under "Publications" is vulnerable to path traversal and exposes limited information, for example, the user can gain information regarding images stored in outside of the WordPress blog, ie, home directories. PoC Enter the following payload into the "Folder" input field of a...
CVE-2021-3311
Affected software: October CMS (core / Auth/Manager.php authentication flow). Vulnerability: session management flaw where an old session ID, invalid after logout, can be reactivated on a new login, effectively allowing reuse of a previously valid session ID. Root cause: improper invalidation of ...
Trend Micro OfficeScan XG and Trend Micro Worry-Free Business Security Server-Side Request Forgery Vulnerabilities
Trend Micro OfficeScan XG and Trend Micro Worry-Free Business Security are both products of Trend Micro, Inc.Trend Micro OfficeScan XG is a distributed anti-virus software.Trend Micro Worry-Free Business Security is an enterprise-class information security solution. Worry-Free Business Security i...
Access Control Error Vulnerability in Multiple Trend Micro Products (CNVD-2021-28309)
Trend Micro OfficeScan XG is a suite of distributed anti-virus software.Trend Micro Apex One is a suite of endpoint security software that provides automated threat detection and response. Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection...
Buffer overflow vulnerability in multiple Trend Micro products (CNVD-2021-28323)
Trend Micro OfficeScan XG is a suite of distributed anti-virus software.Trend Micro Apex One is a suite of endpoint security software that provides automated threat detection and response. Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection...
Access Control Error Vulnerability in Multiple Trend Micro Products (CNVD-2021-28316)
Trend Micro OfficeScan XG is a suite of distributed anti-virus software.Trend Micro Apex One is a suite of endpoint security software that provides automated threat detection and response. Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection...
Access Control Error Vulnerability in Multiple Trend Micro Products (CNVD-2021-28306)
Trend Micro OfficeScan XG is a suite of distributed anti-virus software.Trend Micro Apex One is a suite of endpoint security software that provides automated threat detection and response. Trend Micro Worry-Free Business Security is a suite of enterprise-class information security protection...
CVE-2021-25245
The CVE-2021-25245 entry concerns Trend Micro Worry-Free Business Security 10.0 SP1 with an improper access control flaw that allows unauthenticated remote disclosure of settings information via the web console (default port 4343). The problem originates from insufficient access controls, enablin...
CVE-2021-25235
This CVE (CVE-2021-25235) affects Trend Micro Apex One (on-prem and SaaS) and OfficeScan XG SP1. The root cause is an improper access control that allows an unauthenticated attacker to obtain information about a content inspection configuration file. The vulnerability enables information disclosu...
Automating and operationalizing data protection with Dataguise and Microsoft Information Protection
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. In technical literature, the terms data discovery, classification, and tagging are sometimes used interchangeably, but there are real differences in what they actually mean—and each...
Automating and operationalizing data protection with Dataguise and Microsoft Information Protection
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. In technical literature, the terms data discovery, classification, and tagging are sometimes used interchangeably, but there are real differences in what they actually mean—and each...
Design/Logic Flaw
A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit...
How to Audit Password Changes in Active Directory
Today's admins certainly have plenty on their plates, and boosting ecosystem security remains a top priority. On-premises, and especially remote, accounts are gateways for accessing critical information. Password management makes this possible. After all, authentication should ensure that a user ...