RUSTSEC-2021-0083 QueryInterface should call AddRef before returning pointer

Affected version of this crate, which is a required dependency in com-impl, provides a faulty implementation of the IUnknown::QueryInterface method. QueryInterface implementation must call IUnknown::AddRef before returning the pointer, as describe in this documentation: As it is not incrementing...

CVE-2020-27851

Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...

CVE-2020-27851

Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...

Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS

Exploit Title: Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS Exploit Author: omurugur Vendor Homepage: https://www.oracle.com/security-alerts/cpujan2021.html Version: 11.1.1.7.140715 Author Web: https://www.justsecnow.com Author Social: @omurugurrr Stored XSS:...

Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 XSS

Exploit Title: Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS Exploit Author: omurugur Vendor Homepage: https://www.oracle.com/security-alerts/cpujan2021.html Version: 11.1.1.7.140715 Author Web: https://www.justsecnow.com Author Social: @omurugurrr Stored XSS:...

Mautic 跨站脚本漏洞

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A security vulnerability exists in versions prior to Mautic 3.2.4, which can be exploited by attackers to perform actions on targeted users. These actio...

Netsia SEBA+ 0.16.1 Authentcation Bypass / Add Root User

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netsia SEBA+ %q This module exploits an authentication bypass in Netsia SEBA+, triggered by add new root/admin user. HTTP requests made to the...

CVE-2021-0219: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation, an administrator executes the command...

CVE-2020-27148

The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...

CVE-2020-27148

The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...

Xxe

The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...

CVE-2020-27148

The CVE-2020-27148 issue affects TIBCO EBX Add-ons (EBX Add-on for Oracle Hyperion EPM, EBX Data Exchange Add-on, EBX Insight Add-on) up to version 4.4.2. Root cause: an XML External Entity (XXE) vulnerability that an attacker with network access and low privileges could potentially exploit. Impa...

CVE-2020-27148

The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...

CVE-2021-21470

SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configurati...

CVE-2021-21470

CVE-2021-21470 involves the SAP EPM Add-in for Microsoft Office (v1010) and SAP EPM Add-in for SAP Analysis Office (v2.8) where an authenticated user with privileges can cause an XXE-based attack by supplying attacker-controlled XML configuration files. The underlying issue is that the logging se...

CVE-2021-21470

SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configurati...

CVE-2021-21470: Improper Restriction of XML External Entity Reference

SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in applications that accept attacker-controlled XML configurati...

Tibco EBX Add-ons Security Breach

Tibco EBX Add-ons is an add-on from Tibco USA that enhances the functionality of the Tibco Ebx data management platform. A code issue vulnerability exists in TIBCO EBX version 4.4.2 and earlier, which can be exploited by an attacker to perform XML External Entity XXE attacks...

CVE-2020-27148: Improper Restriction of XML External Entity Reference

The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity XXE...

TIBCO Security Advisory: January 12, 2021 - TIBCO EBXAdd-ons

TIBCO EBX EXML External Entity Original release date: January 12, 2021 Last revised: CVE-2020-27148 Source: TIBCO SoftwareInc. TIBCO EBX EXML External Entity Original release date: January 12, 2021 Last revised: --- Source: TIBCO Software Inc. Systems Affected TIBCO EBX Add-ons versions 4.4.2 and...