Sysdream is recruiting About Training Penetration tests Technical audits PCI DSS The lab Contact 1 2 3 4 5 Training Improve your skills by taking part in our various tailor-made training courses. See our trainings IS security service Identify your security vulnerabilities in order to protect your IS. Our expertise MALICE - Cyber Training Train your teams in computer warfare and simulate a cyber defense environment. More information Events Take part in our IT security events and conferences. Our events What's new at Sysdream? 19 OCT 2016 SPIP 3.1.2 Server Side Request Forgery (CVE-2016-7999) SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU / GPL license. It's possible to send HTTP / FTP requests using the valider_xmlfile. Attackers can make it look like the server is sending the request, possibly bypassing access controls such as a firewall that would prevent the attacker from accessing the URLs directly. Read more 19 OCT 2016 SPIP 3.1.2 Template Compiler / Composer PHP Code Execution (CVE-2016-7998) SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU / GPL license. The SPIP template composer/compiler does not correctly handle SPIP "INCLUDE/INCLURE" Tags, allowing PHP code execution by an authenticated user. This vulnerability can be exploited using the CSRF or the XSS vulnerability also found in this advisory. Lire la suite 19 OCT 2016 SPIP 3.1.1/3.1.2 File Enumeration / Path Traversal (CVE-2016-7982) SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU/GPL licence. The valider_xml file can be used to enumerate files on the system. Lire la suite 19 OCT 2016 SPIP 3.1.2 Exec Code Cross-Site Request Forgery (CVE-2016-7980) SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU / GPL license. The vulnerable request to valider_xml(see: SPIP 3.1.2 Template Compiler / Composer PHP Code Execution - CVE-2016-7998 ) is vulnerable to Cross-Site Request Forgery, allowing the execution of the CVE-2016-7998 attack by tricking an administrator to open the malicious link. Read more The next trainings March 2021 Today Mon. Mar. Wed. Game. Fri. 1 2 3 4 5 8 9 10 11 12 15 16 17 18 19 22 23 24 25 26 29 30 31 1 2 5 6 7 8 9 All our training CONTACT Address: 14 place Marie-Jeanne Bassot 92300 Levallois-Perret France Telephone: + 33 1 78 76 58 00 E-mail: info@sysdream.com ZOOM ON Penetration tests Architecture audit Exposure test Recruitment Cyber-training platform Contact © Sysdream 2008 - 2016 - Approval number 11930594993 CGV - CGU