OX App Suite / OX Documents 7.10.3 XSS / SSRF / Improper Validation

Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne. Yours sincerely, Martin Heiland, Open-Xchange GmbH...

kernel: perf_event_open() and execve() race in setuid programs allows a data leak

A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. As no relevant locks in particular the credguardmutex are held during the ptracemayaccess call, it is possible for the specified target task to perform an execve syscall with setuid execution...

[SECURITY] Fedora 31 Update: libEMF-1.0.12-1.fc31

libEMF is a library for generating Enhanced Metafiles on systems which don't natively support the ECMA-234 Graphics Device Interface GDI. The library is intended to be used as a driver for other graphics programs such as Grace or gnuplot. Therefore, it implements a very limited subset of the GDI...

CVE-2020-1126: Out-of-bounds Write

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

Mail.ru: User session access due to Oauth whitelist host bypass and postMessage

A destination for postMessage was not properly restricted on connect.mail.ru allowing crossite access to session, as was shown for 3k.mail.ru application session. Both connect.mail.ru and 3k.mail.ru belong to Ext.B scope, this scope does not offer a bounty for attacks with clientside vectors on t...

The vulnerability of Microsoft Excel editors, Microsoft Office programs, and Office 365 ProPlus allows a hacker to execute arbitrary code in the context of the current user.

The vulnerability of Microsoft Excel editors, as well as Microsoft Office programs and Office 365 ProPlus, stems from an operation that goes beyond buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, usi...

CVE-2020-12473

MonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting from ffmpeg.exe to a different program...

Code injection

MonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting from ffmpeg.exe to a different program...

CVE-2020-12473

MonoX CMS

PT-2020-15077

🚨 CVE-2020-1804 Huawei Honor V10 smartphones with versions earlier than 10.0.0.156C00E156R2P4 has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may caus...

Directory traversal

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

CVE-2020-11008

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260GHSA-qm7j-c969-7j4q. The fix for that bug still left the door open for an exploit where some credential is leaked but...

Unspecified Vulnerability in McAfee Endpoint Security (CNVD-2020-24146)

McAfee Endpoint Security ENS is the United States McAfee McAfee company's set of framework for providing intelligent collaboration and advanced threat defense. The framework supports the entire threat defense lifecycle of real-time communications control and actionable threat forensics and so on....

PT-2020-19515

Name of the Vulnerable Software and Affected Versions McAfee Endpoint Security ENS for Windows versions prior to 10.7.0 April 2020 Update Description The issue concerns accessing functionality not properly constrained by ACLs in the autorun start-up protection, allowing local users to manipulate...

Microsoft RMS Sharing App for Mac Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries. An attacker could then install programs; view, change, or delete data with the logged in user's privileges. To exploit this vulnerability, an attacker would first...

AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-29592 Potential Impact: Denial of service, privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: CVE-2013-4312, CVE-2013-7446, CVE-2014-3631, CVE-2014-5206, CVE-2014-5207, CVE-2014-6410, CVE-2014-7145, CVE-2014-782...

MS15-013: Description of the security update for Microsoft Office 2013: February 10, 2015

MS15-013: Description of the security update for Microsoft Office 2013: February 10, 2015 Introduction This security update resolves vulnerabilities that could allow security feature bypass if a specially crafted file is opened in an affected edition of Microsoft Office. Summary Microsoft has...

Important: Red Hat Security Advisory: qemu-kvm security and bug fix update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2019-11191

The Linux kernel allows local users to bypass ASLR protections for setuid a.out programs when CONFIGIA32AOUT is enabled and ia32aout module is loaded, because installexeccreds is called too late in the loadaoutbinary in fs/binfmtaout.c. Due to this, the ptracemayaccess check may have a race...

kernel: perf_event_open() and execve() race in setuid programs allows a data leak

A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. As no relevant locks in particular the credguardmutex are held during the ptracemayaccess call, it is possible for the specified target task to perform an execve syscall with setuid execution...