CVE-2020-25256

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. PKI certificates have a private key that is the same across different customers' installations...

CVE-2020-25256

CVE-2020-25256 affects Hyland OnBase versions listed in the description (16.0.2.83 and below; 17.0.2.109 and below; 18.0.0.37 and below; 19.8.16.1000 and below; 20.3.10.1000 and below). Root cause: PKI certificates share a private key across different customers’ installations. Impact, as stated, ...

CVE-2020-25257

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files...

CVE-2020-25257

Hyland OnBase is affected by CVE-2020-25257, with XXE vulnerabilities that allow read/write access to arbitrary files. Affected versions include OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below, and 20.3.10.1000 and below. The connected documents confi...

CVE-2020-25258

CVE-2020-25258 (Hyland OnBase) affects OnBase versions 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below, and 20.3.10.1000 and below. The issue arises from using ASP.NET BinaryFormatter.Deserialize in SOAP messages, enabling an attacker to transmit and execute...

CVE-2020-25258

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses ASP.NET BinaryFormatter.Deserialize in a manner that allows attackers to transmit and execute bytecode in SOAP messages...

CVE-2020-25259

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses XML deserialization libraries in an unsafe manner...

CVE-2020-25259

CVE-2020-25259 affects Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below, and 20.3.10.1000 and below. The root cause is the unsafe use of XML deserialization libraries. The CVSS data indicates a network-exposed vector with high criticality (C/H/I...

CVE-2020-25260

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows remote attackers to execute arbitrary code because of unsafe JSON deserialization...

CVE-2020-25260

CVE-2020-25260 affects Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below, and 20.3.10.1000 and below. The issue arises from unsafe JSON deserialization, allowing remote attackers to execute arbitrary code. Connected documents confirm the root cau...

Hyland OnBase Arbitrary Code Execution Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase has a security vulnerability in version 18.0.0.32 that stems from insecure JSON deserialization, which can be exploited by an attacker to remotely execute arbitrary code...

Hyland OnBase SQL Injection Vulnerability (CNVD-2020-52046)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from an SQL injection vulnerability. An attacker can exploit this vulnerability to conduct SQL injection attacks via TestConnectionLocalOrLinkedServer, CreateFilterFriendlyVie...

Hyland OnBase Bytecode Execution Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase has a bytecode execution vulnerability that stems from a problem with the way OnBase uses ASP.NET BinaryFormatter.Deserialize, which can be exploited by an attacker to transmit and...

Hyland OnBase Directory Traversal Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to read a file via the FileName parameter...

Hyland OnBase XXE Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from an XXE vulnerability that can be exploited by an attacker to gain read/write access to arbitrary files...

Hyland OnBase XML Deserialization Library Insecure Use Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase is vulnerable to an unsafe use of the XML deserialization library. No detailed vulnerability details are provided at this time...

Hyland OnBase Cross-Site Request Forgery Vulnerability (CNVD-2020-52044)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. A cross-site request forgery vulnerability exists in Hyland OnBase. The vulnerability stems from the presence of default credentials. An attacker could exploit the vulnerability to enable user logi...

Hyland OnBase Denial of Service Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a denial of service vulnerability that can be exploited by an attacker to cause a denial of service via a long user ID...

Hyland OnBase Directory Traversal Vulnerability (CNVD-2020-51794)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to write to a file via the FileName parameter...

Hyland OnBase SQL Injection Vulnerability (CNVD-2020-52045)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker to conduct a SQL injection attack via the TableName, ColumnName, Name, UserId, or Passwor...