CVE-2020-13248

BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx...

CVE-2020-13248

BooleBox Secure File Sharing Utility pre-4.2.3.0 suffers a stored XSS vulnerability (CVE-2020-13248) in the My Account avatar data sent to Account.aspx. A crafted avatar field can execute scripts in the affected session. Root cause: insufficient validation of the avatar JSON parameter. The CVE en...

CVE-2020-13248: Improper Neutralization of Input During Web Page Generation

BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx...

PT-2020-13395

Name of the Vulnerable Software and Affected Versions BooleBox Secure File Sharing Utility versions prior to 4.2.3.0 Description The issue allows for stored XSS via a crafted avatar field within My Account JSON data to the "Account.aspx" endpoint. This can be exploited by manipulating the avatar...

PT-2020-13394

Name of the Vulnerable Software and Affected Versions BooleBox Secure File Sharing Utility versions prior to 4.2.3.0 Description The issue allows for CSV injection through a crafted user name that is mishandled during export from the activity logs in the Audit Area. Recommendations For versions...

CVE-2020-13247: Improper Neutralization of Formula Elements in a CSV File

BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the activity logs in the Audit Area...

New Privacy Features Added to the Upcoming Apple iOS 14 and macOS Big Sur

Unprecedented times call for unprecedented measures. No, we're not talking about 'coronavirus,' the current global pandemic because of which Apple—for the very first time in history—organized its Worldwide Developer Conference WWDC virtually. Here we're talking about a world in which we are all...

VirusTotal Adds Cynet's Artificial Intelligence-Based Malware Detection

VirusTotal, the famous multi-antivirus scanning service owned by Google, recently announced new threat detection capabilities it added with the help of an Israeli cybersecurity firm. VirusTotal provides a free online service that analyzes suspicious files and URLs to detect malware and...

Open Banking Around the World

Open Banking, the practice of sharing financial data with competitors and third parties via open APIs, offers many benefits for consumers who not only have more control over their data, but who can now manage their finances much more efficiently. What started with the European Union Payment...

Hackers Leaked 269 GB of U.S. Police and Fusion Centers Data Online

A group of hacktivists and transparency advocates has published a massive 269 GB of data allegedly stolen from more than 200 police departments, fusion centers, and other law enforcement agencies across the United States. Dubbed BlueLeaks, the exposed data leaked by the DDoSecrets group contains...

Unauthorized Access Vulnerability in MM-Wiki

MM-Wiki is a lightweight enterprise knowledge sharing and team collaboration software for building enterprise Wiki and team knowledge sharing platforms. MM-Wiki suffers from an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

11 security tips to help stay safe in the COVID-19 era

The COVID-19 pandemic has changed our daily routines, the ways we work, and our reliance on technology. Many of us are now working remotely, students are attending classes virtually, and we’re relying more on social media and social networks to stay connected as we define what our new normal look...

GDI+ Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface GDI handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or dele...

Can Governments Defeat Nation-State Attacks on Critical Infrastructures?

For physical conflicts, we expect our government to protect us from nation-state adversaries. It turns out, though, that industrial enterprises are much better positioned to defeat most nation-state attacks on power plants, pipelines, and other critical infrastructures than governments are. For...

Unspecified Vulnerability in Abstrium Pydio Cells

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by Abstrium France. A security vulnerability exists in Abstrium Pydio Cells version 2.0.4. The vulnerability can be exploited by an attacker to obtain the associated hidden account username and password,...

PT-2020-13293

Name of the Vulnerable Software and Affected Versions Pydio Cells version 2.0.4 Description In Pydio Cells, when an authenticated user shares a file and selects the option to create a public link, a hidden shared user account is created in the backend with a random username. If an anonymous user...

Nextcloud: Allows any user to share their "Root" level folder by sharing "."

There seems to be a bug in the "File to Share" feature of Nextcloud Talk. This allows any authenticated user/admin to share their "root" level folder by manipulating the "path": parameter in the JSON body request to the remote API /nextcloud/ocs/v2.php/apps/filessharing/api/v1/shares Steps to rep...

Zoom Client Application Chat Code Snippet Remote Code Execution Vulnerability

Summary An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacke...

Nextcloud: Re-Sharing allows increase of privileges

User A shares a file/folder to user B with re-sharing permission, but readonly - User B shares this file/folder to User C Needs the shareapidefaultpermissions set to 1 all checkmarks off in admin panel - User B can add write permissions for the share to User C User C may also be anonymous using a...

Creating a HAR file from your browser to share with support

IMPORTANT: Please note that HAR files contain sensitive clear text data including content of pages while recording, such as user names, passwords, keys, etc, and should only be shared with trusted recipients via secure channels such ashttps://cis.citrix.com.Sharing files via email is not...