PT-2020-2770

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform Crystal Reports versions 4.1, 4.2 Description The issue allows an attacker with basic authorization to inject code that can be executed by the application, leading to Remote Code Execution...

NewStart CGSL CORE 5.04 / MAIN 5.04 : apache-commons-beanutils Vulnerability (NS-SA-2020-0011)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has apache-commons-beanutils packages installed that are affected by a vulnerability: - In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to acces...

Remote Code Execution (RCE)

hessian is vulnerable to remote code execution RCE attacks. The vulnerability exists due to lack of filtering of untrusted object in the function 'readObject', allowing an attacker to bypass the blacklist by sending malicious serialized Hessian objects...

GHSA-H4MF-75HF-67W4 Information disclosure in parse-server

you can fetch all the users' objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken "SessionToken":"$regex":"r:027f" and find valid accounts this way. Using this method, it's possible to retrieve accounts without interaction from the users. GET...

CVE-2019-14893

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

CVE-2019-14893

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

CVE-2019-14893

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when...

Design/Logic Flaw

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype...

CVE-2019-10798

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype...

USN-4282-1 postgresql-10, postgresql-11 vulnerability

It was discovered that PostgreSQL incorrectly performed authorization checks when handling the "ALTER ... DEPENDS ON EXTENSION" sub-commands. A remote attacker could possibly use this issue to drop any function, procedure, materialized view, index, or trigger under certain conditions...

Microsoft Windows Win32k Elevation of Privilege Vulnerability (CNVD-2020-14702)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows Win32k, which arises from a failure of the Windows kernel mode driver to properly handle objects in memory. The...

SAP Business Objects Business Intelligence Platform Information Disclosure Vulnerability (CNVD-2020-12765)

SAP Business Objects Business Intelligence Platform is a suite of bookstore intelligence software and enterprise performance solutions from Germany's SAP. The product features report generation, analytics and data visualization. An information disclosure vulnerability exists in SAP Business Objec...

SAP BusinessObjects Business Intelligence XSS

The vulnerability of the SAP BusinessObjects Business Intelligence platform exists due to deficiencies in the encryption of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

Design/Logic Flaw

This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Foxit Reader Reuse After Release Remote Code Execution Vulnerability

Foxit Reader old name: Foxit PDF Reader is a set of software used to read PDF format files, by Fujian Foxit Software developed by Foxit Reader is a set of free to use the software, the operating system is mainly based on Microsoft Windows, and as long as there is a Win32 implementation of the...

Foxit PhantomPDF Memory Misreference Code Execution Vulnerability (CNVD-2020-10627)

PhantomPDF is a Chinese Foxit Foxit company for enterprise-level users of PDF document processing software. A memory error referencing remote code execution vulnerability exists in the handling of text field objects in Foxit PhantomPDF 9.7.0.29455 and earlier versions. The vulnerability stems fro...

CVE-2020-8857

CVE-2020-8857 affects Foxit Reader 9.7.0.29455 (and related versions in some records) where the flaw resides in parsing of form Annotation objects within AcroForms. The root cause is failure to validate the existence of an object before performing operations on it, leading to remote code executio...

CVE-2020-8846

This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-8857: Use After Free

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...