CVE-2020-7637

CVE-2020-7637 affects class-transformer versions prior to 0.3.1. The vulnerability stems from classToPlainFromExist allowing a proto payload to pollute Object.prototype, enabling attacker-controlled modification of object properties. Impact is described as prototype pollution; upstream fixes requ...

CVE-2020-7637

class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

PT-2020-19673 · None · Class-Transformer

Name of the Vulnerable Software and Affected Versions: class-transformer versions prior to 0.3.1 Description: The issue allows attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a proto payloa...

Prototype Pollution

Overview class-transformer is a Proper decorator-based transformation / serialization / deserialization of plain javascript objects to class constructors. Affected versions of this package are vulnerable to Prototype Pollution the classToPlainFromExist function could be tricked into adding or...

CVE-2019-12400

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this...

UBUNTU-CVE-2020-10960

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...

Unspecified Vulnerability in codeBeamer

Intland Software codeBeamer ALM is an application lifecycle management platform from Intland Software, Germany. The platform supports application lifecycle management, requirements management, risk management and software development. A security vulnerability exists in codeBeamer versions prior t...

CVE-2019-20635

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

CVE-2019-20635

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields...

EulerOS Virtualization for ARM 64 3.0.6.0 : PyYAML (EulerOS-SA-2020-1371)

According to the version of the PyYAML package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and loadall functions because of a class deserializatio...

The Zoom Privacy Backlash Is Only Getting Started

A class action lawsuit. Rampant zoombombing. And as of today, two new zero-day vulnerabilities...

CVE-2018-7757

Memory leak in the sassmpgetphyevents function in drivers/scsi/libsas/sasexpander.c in the Linux kernel allows local users to cause a denial of service kernel memory exhaustion via multiple read accesses to files in the /sys/class/sasphy directory...

Sql injection

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and...

Exceptions displayed in non-debug configurations in Symfony

Description ----------- When ErrorHandler renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-debug environments. Resolution ---------- The...

PT-2020-2139 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.34.1 Description: The issue in MediaWiki is related to the lack of proper output encoding or escaping, which can be exploited by a remote attacker to impact data integrity. Users can add various Cascading Style...

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal

Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Exploit Title: Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal Date: 2020-03-26 Exploit Author: hongphukt Vendor Homepage: https://www.jinfonet.com/ Software Link: https://www.jinfonet.com/product/download-jreport/ Version:...

jackson-databind: default typing mishandling leading to remote code execution

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLAS...

Arbitrary File Deletion Vulnerability in YCCMS controller directory Pi***.cl***.php

YCCMS is a PHP version of a lightweight CMS builder. YCCMS 3.4 version controller directory Pi.class.php arbitrary file deletion vulnerability, an attacker can use the vulnerability to delete arbitrary files...

Unknown 'WildPressure' Malware Campaign Lets Off Steam in Middle East

A malware campaign that shares no known similarities to previous attacks has been uncovered, targeting organizations in the Middle East. Dubbed “WildPressure,” the campaign used a previously unknown malware that researchers named Milum, after the C++ class names inside the code. According to...

CVE-2019-20551

An issue was discovered on Samsung mobile devices with N7.x, O8.x, and P9.0 software. Attackers can bypass Factory Reset Protection FRP via a Class 0 Type Message. The Samsung ID is SVE-2019-14941 October 2019...