858 matches found
Blind SSRF When Uploading Presentation (mitigation bypass)
Description This is actually a bypass of CVE-2023-33176 when i able to perform SSRF to internal network. Proof of Concept As we already know, we can upload files via api /bigbluebutton/api/insertDocument using a remote url. PresentationUrlDownloadServicesavePresentation is the method to handle th...
How To Present SecOps Metrics (The Right Way)
SecOps metrics can be a gold mine of potential for informing better business decisions, but 78% of CEOs say they don’t have adequate data on risk exposure to make good decisions. Even when they do see the right data, 82% are inclined to “trust their gut” anyway. Here lies the disconnect between...
The vulnerability of the Microsoft OneNote note-taking software, related to errors in information presentation on the user interface, allows a hacker to perform spoofing attacks.
The vulnerability of the Microsoft OneNote note-taking software relates to information representation errors in the user interface. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...
[Lost Bots] S03 E04 A Security Leader’s Playbook for the C-suite
!\Lost Bots\ S03 E04 A Security Leader’s Playbook for the C-suitehttps://blog.rapid7.com/content/images/2023/07/The-Lost-Bots-logo-large.png In a special two-part “Lost Bots,” hosts Jeffrey Gardner and Stephen Davis talk about presenting cybersecurity results up the org chart. Both have handled...
CVE-2023-33176
BigBlueButton (BBB) SSRF vulnerability (CVE-2023-33176) enables server-side request forgery via the insertDocument URL for presentation downloads. The public descriptions describe that the URL supplied could be used without proper validation, leading to SSRF. A patch updated PresentationUrlDownlo...
CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton
BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...
CVE-2023-33176 Blind SSRF When Uploading Presentation in BigBlueButton
BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery SSRF vulnerability. In an insertDocument API request the user is able to supply a URL from which the presentation should be...
PT-2023-24192 · Unknown · Bigbluebutton
Name of the Vulnerable Software and Affected Versions: BigBlueButton affected versions not specified Description: BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions, a Server-Side Request Forgery SSRF vulnerability exists. Th...
The vulnerability of the Microsoft Dynamics 365 for Finance and Operations resource planning software, related to errors in the user interface’s information presentation, allows attackers to perform spear-phishing attacks.
The vulnerability of the Microsoft Dynamics 365 for Finance and Operations resource planning software is related to errors in information presentation by the user interface. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...
The vulnerability of the Azure DevOps Server software, related to errors in information presentation on the user interface, allows attackers to perform spear-phishing attacks.
The vulnerability of the Azure DevOps Server software relates to errors in information presentation by the user interface. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...
Remote Code Execution (RCE)
Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. A vulnerability exists in how WPF applications load and render XPS documents which may result in remote code execution. Remediation Upgrade Microsoft.WindowsDesktop.App.Runtime.win-x64 to version 6.0.18, 7.0.7...
Remote Code Execution (RCE)
Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. A vulnerability exists in how WPF applications load and render XPS documents which may result in remote code execution. Remediation Upgrade Microsoft.WindowsDesktop.App.Runtime.win-x86 to version 6.0.18, 7.0.7...
Odoo 安全漏洞
Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in the Python language, with PostgreSQL as the database, and includes modules for sales management, inventory management, and financial management. A security...
[SECURITY] Fedora 38 Update: php-Smarty-3.1.48-1.fc38
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. This implies that PHP code is application logic, and is separated from the presentation. Autoloader: /usr/share/php/Smarty/autoload.php...
Fedora: Security Advisory for php-Smarty (FEDORA-2023-4b03f6cd8a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 36 Update: php-Smarty-3.1.48-1.fc36
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. This implies that PHP code is application logic, and is separated from the presentation. Autoloader: /usr/share/php/Smarty/autoload.php...
[SECURITY] Fedora 37 Update: php-Smarty-3.1.48-1.fc37
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. This implies that PHP code is application logic, and is separated from the presentation. Autoloader: /usr/share/php/Smarty/autoload.php...
Pakistan-Origin SideCopy Linked to New Cyberattack on India's Ministry of Defence
An advanced persistent threat APT group that has a track record of targeting India and Afghanistan has been linked to a new phishing campaign that delivers Action RAT. According to Cyble, which attributed the operation to SideCopy , the activity cluster is designed to target the Defence Research...
The vulnerability of the Microsoft OneNote note-taking software, related to errors in information presentation on the user interface, allows a perpetrator to exploit their privileges.
The vulnerability of the Microsoft OneNote note-taking software relates to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...
