1061 matches found
XWiki Platform 注入漏洞
XWiki Platform is a suite of wiki platforms for creating web collaboration applications from XWiki France. The XWiki Platform suffers from an injection vulnerability that originates from the execution of arbitrary script macros, including Groovy and Python macros that allow remote code execution,...
XWiki Platform 注入漏洞
XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company XWiki. XWiki Platform suffers from an injection vulnerability that originates from the execution of arbitrary script macros, including Groovy and Python macros that allow remote code...
XWiki Platform 注入漏洞
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from XWiki France. XWiki Platform suffers from an injection vulnerability that stems from the ability to display or interact with any page that is inaccessible to the user through a combination of asynchronous...
Default configuration
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki...
XWiki Commons 代码注入漏洞
XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that any user with view permissions to normally accessible documents, including legacy notification activity macros, can execute arbitrary...
borsh-schema-writer (=0.1.0), borsh-serde-adapter (=0.1.0) +7 more potentially affected by unknown CVE via borsh (>=0.10.2 <=0.10.3)
borsh CARGO version =0.10.2, =0.4.2, =0.4.1, =0.4.3 - pchain-world-state =0.4.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0033...
Microsoft Tightens OneNote Security by Auto-Blocking 120 Risky File Extensions
Microsoft has announced plans to automatically block embedded files with "dangerous extensions" in OneNote following reports that the note-taking service is being increasingly abused for malware delivery. Up until now, users were shown a dialog warning them that opening such attachments could har...
Apache OpenOffice < 4.1.14 Multiple Vulnerabilities (macOS)
The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.14. It is, therefore, affected by multiple vulnerabilities: - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 - Apache OpenOffice versions before 4.1.14 may b...
CVE-2022-47502
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected...
CVE-2022-47502 Apache OpenOffice: Macro URL arbitrary script execution
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected...
Medium: rust
Issue Overview: Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, making it available to the Rust projects it builds. To reco rd when an extraction is successful, Cargo writes "ok" to the...
Threat Roundup for March 10 to March 17
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 10 and March 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...
Winter Vivern APT Group Targeting Indian, Lithuanian, Slovakian, and Vatican Officials
The advanced persistent threat known as Winter Vivern has been linked to campaigns targeting government officials in India, Lithuania, Slovakia, and the Vatican since 2021. The activity targeted Polish government agencies, the Ukraine Ministry of Foreign Affairs, the Italy Ministry of Foreign...
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Impact It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters formtoken=1&action=create. For instance:...
XWiki Platform 跨站脚本漏洞
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that stems from the ability of a user without scripting privileges to use live data macros to cause stored cross-site scripting...
Amazon Linux 2 : rust (ALAS-2023-1959)
The version of rust installed on the remote host is prior to 1.66.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1959 advisory. Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code ...
SUSE CVE-2010-0136
OpenOffice.org OOo 2.0.4, 2.4.1, and 3.1.1 does not properly enforce Visual Basic for Applications VBA macro security settings, which allows remote attackers to run arbitrary macros via a crafted document...
SUSE CVE-2014-0247
LibreOffice 4.2.4 executes unspecified VBA macros automatically, which has unspecified impact and attack vectors, possibly related to doc/docmacromode.cxx...
SUSE CVE-2017-9749
The regs macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during "objdump -D" execution...