FreeBSD : py-matrix-synapse -- multiple vulnerabilities (38d2df4d-b143-11e9-87e7-901b0e934d69)

Matrix developers report : The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation : - Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms. - Prevent a...

py-matrix-synapse -- multiple vulnerabilities

Matrix developers report: The matrix team releases Synapse 1.2.1 as a critical security update. It contains patches relating to redactions and event federation: Prevent an attack where a federated server could send redactions for arbitrary events in v1 and v2 rooms. Prevent a denial-of-service...

CVE-2018-19434

The CVE-2018-19434 issue affects webERP 4.15 within the General Ledger component, specifically the Bank Account Matching - Receipts screen. BankMatching.php contains a Blind SQL injection vulnerability via the AmtClear_ parameter that can be exploited remotely to execute SQL commands. This vulner...

webERP General Ledger Component SQL Injection Vulnerability

webERP is an open source inventory and financial management system ERP system. The system supports inventory management , rights role management , order management and financial management , etc. General Ledger is one of the ledger components . A SQL injection vulnerability exists in the 'Bank...

RecargaPay: IDOR exposes receipts of all users.

@cablej found an insecure direct object reference IDOR that could expose receipts from external users. Thanks for helping us make RecargaPay more secure!...

Harvest: Unauthorised read Access to Expense Receipt of any user in the company(Vertical Privilege escalation)

Hi Team, Description : In Timesheet you have option for submitting your expense for the projects you are assigned. But Only Admin can view other user's Expenses and related receipts. But there is a request which gives a full size of expense receipt attached to the expenses. This request is...

Harvest: XSS on expenses attachments

Summary ------ Hey there! After 152591 was fixed, I decided to take another look at the attachments and found a new bypass to upload attachments which will be served with a user-controlled Content-type. The invoices attachments are not vulnerable, as they are all served with Content-Disposition:...

Threat Outbreak Alert RuleID11616: Email Messages Distributing Malicious Software on September 18, 2014

Medium Alert ID: 35767 First Published: 2014 September 18 15:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID11616 and RuleID11616KVR may contain the...

Microsoft Research Proposes E-Voting Attack Mitigation

Microsoft Research has proposed a mitigation for a known potential attack against verifiable electronic voting machines that could help prevent insiders from being able to alter votes after the fact. The countermeasure to the “trash attack” involves adding a cryptographic hash to the receipts tha...

Fake Amazon Receipt Generator Dupes Merchants

A new scam has been circulating the internet lately that aims to swindle Amazon sellers by generating fake receipts. Amazon Receipt Generator, an executable file, has been making the rounds on hacking forums for the last few months. The program allows scammers to input an array of fake informatio...

Becky! Internet Mail buffer overflow vulnerability

Overview Becky! Internet Mail contains a buffer overflow vulnerability. Becky! Internet Mail is an email client software. Becky! Internet Mail contains a buffer overflow vulnerability as it does not properly handle read receipt requests. Yuji Ukai of Fourteenforty Research Institute, Inc. reporte...