openSUSE Security Update : libreoffice (openSUSE-2017-807)

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements : Writer : - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc : - New...

Q&A: Conducting Cloud-Based Vendor Risk Audits With Qualys SAQ

Third-party security assessments drastically reduce your organization’s risk of suffering a data breach. When carried out properly, these assessments identify poor InfoSec and privacy practices among your vendors, partners, contractors, and other third parties with access to your IT systems and...

SUSE-SU-2017:1821-1 Security update for libreoffice

LibreOffice was updated to version 5.3.3.2, bringing new features and enhancements: Writer: - New 'Go to Page' dialog for quickly jumping to another page. - Support for 'Table Styles'. - New drawing tools were added. - Improvements in the toolbar. - Borderless padding is displayed. Calc: - New...

The vulnerability of XSLT programs for viewing and editing PDF files in Adobe Reader, Adobe Acrobat Document Cloud, Adobe Acrobat, and Adobe Reader Document Cloud allows attackers to execute arbitrary code.

The vulnerability of XSLT programs for viewing and editing PDF files in Adobe Reader, Adobe Acrobat Document Cloud, Adobe Acrobat, and Adobe Reader Document Cloud arises from operations that go beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrar...

Mixmax: Stored XSS in Templates>Enahance>Social Badges

Hi, just like the report 237927, I found stored XSS in TemplatesEnhance Social Badges section. 1. Go to templates section and click on one of your templates. 2. Enhance Social Badges. 3. Enter the payload: javascript:alert1 in any of the social networking button url. 4. You'll see that the xss is...

Mixmax: Stored XSS templates -> 'call for action' feature

Hi Jeff, Reporting the Stored XSS in template section on 'call for action' button. Already discussed in mail 1 Login to Mixmax and navigate to template section 2 Click on enhance and select call for action button 3 Enter anything in button text and in URL enter XSS payload...

CVE-2017-8438

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the runas functionality. This bug prevents transitioning into the specified user specified in a runas request. If a role has been created using a template that contains the user properties, the behavior of runas...

Infect Android Application With Meterpreter Payload: kwetza

Infect Android Application With Meterpreter Payload Kwetza infects an existing Android application with either custom or default payload templates to avoid detection by antivirus. Kwetza allows you to infect Android applications using the target application’s default permissions or inject...

Faraday v2.5 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

InsightVM/Nexpose Patch Tuesday Reporting

Many of our customers wish to report specifically on Microsoft patch related vulnerabilities. This often includes specific vulnerabilities that are patched in Patch Tuesday updates. This post will show you the various ways that you can create reports for each of these. Remediation Projects...

F5 Networks BIG-IP : BIG-IP Azure cloud vulnerability (K61757346)

In some circumstances, a BIG-IP Azure cloud instance may contain a default administrative password which can be used to remotely log in to the BIG-IP system. The affected administrative account is the Azure instance administrative user created at deployment. The root and admin accounts are not...

CVE-2016-5979

IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with security profile not valid for the templates, that results in the new instance not accessible for the intended user. IBM X-Force ID: 116379...

CVE-2016-7404

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform...

Unsafe Lookup

ansible is vulnerable to unsafe lookups. The library does not wrap the jinja2 environment properly, resulting in the lookup results being rendered as unicode strings. This can result in arbitrary code being executed in the templates...

CVE-2017-2116

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...

CVE-2017-2116

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...

Authentication flaw

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...

CVE-2017-2116

Cybozu Office 10.0.0–10.5.0 contains an access restriction bypass in the templates delete function for the ustomappeature, enabling remote authenticated attackers to delete ustomappmplates via unspecified vectors. The CVE is CVE-2017-2116. The vulnerability is documented across multiple sourc...

CVE-2017-2116

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors...

Trend Micro Control Manager cgiShowClientAdm Security Bypass

The version of Trend Micro Control Manager running on the remote host is affected by a security bypass vulnerability when processing calls to the cgiShowClientAdm web function due to a failure to provide authentication for the functionality that exposes, modifies, or deletes DLP templates involve...