CVE-2020-6247: Undefined Security Weakness

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability...

CVE-2020-6257: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform CMC and BI Launchpad 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...

PT-2020-2519

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A remote code execution issue exists in the way Windows handles objects in memory. This allows remote attackers to execute arbitrary code and affect the system. Recommendations At the moment,...

PT-2020-19041

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an attacker with access to a local instance to inject files or code that can be executed by the application due to improper control of resource...

PT-2020-2521

Name of the Vulnerable Software and Affected Versions Windows versions prior to 10.0.18363 Description An elevation of privilege issue exists due to the Windows kernel-mode driver's failure to properly handle objects in memory. This allows an attacker to potentially elevate their privileges. The...

PT-2020-19052

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform CMC and BI Launchpad version 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting issue. Recommendations For SAP Busine...

PT-2020-2455

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to the Graphics Device Interface GDI component of the Windows operating system and is associated with insecure privilege management. It may allow an attacker to elevate...

PT-2020-19047

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an attacker to access restricted information under certain conditions or error scenarios. Recommendations For SAP Business Objects Business Intelligen...

CVE-2020-6242: Missing Authentication for Critical Function

SAP Business Objects Business Intelligence Platform Live Data Connect, versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing...

PT-2020-19043

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an unauthenticated attacker to prevent legitimate users from accessing a service by crashing or flooding the Central Management Server, thereby...

CVE-2020-6251: Undefined Security Weakness

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted...

(Pwn2Own) Adobe Acrobat Reader DC Field Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Adobe Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Field...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

Deserialization of untrusted data

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-1714

A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. Mitigati...

Updated ruby-json packages fix security vulnerability

Updated ruby-json packages fix security vulnerability: In ruby-json before 2.3.0, there is an unsafe object creation vulnerability. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system CVE-2020-10663...

CVE-2020-5885

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...

CVE-2020-5886

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability HA pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...

CVE-2020-5885

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability HA pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only o...