CVE-2020-7572

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...

CVE-2020-7572

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Huawei FusionCompute Encryption Issue Vulnerability

Huawei FusionCompute is a software for virtualization support from Huawei, a Chinese company. The software is a virtualization engine that provides virtualization support for cloud hosts. A security vulnerability exists in FusionCompute version 8.0.0, which can be exploited by an attacker with...

The vulnerability of the Windows MSCTF Server component of the Windows operating system allows attackers to disclose protected information.

The vulnerability of the Windows MSCTF Server component exists due to insufficient testing of input data. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the Intel Unite conference call software relates to the execution of operations beyond the buffer in memory, allowing an attacker to disclose protected information.

The vulnerability of the Intel Unite conference communication software relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...

CVE-2020-4655

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM...

CVE-2020-13772

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...

CVE-2020-8583

Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session...

CVE-2020-8747

Out-of-bounds read in subsystem for IntelR AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access...

“Privacy Nutrition Labels” in Apple’s App Store

Apple will start requiring standardized privacy labels for apps in its app store, starting in December: Apple allows data disclosure to be optional if all of the following conditions apply: if its not used for tracking, advertising or marketing; if its not shared with a data broker; if collection...

The vulnerability of the Console component of the Oracle WebLogic Server application server allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Console component of the Oracle WebLogic Server application server is related to errors in code generation management. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through...

CVE-2020-26809

SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and...

PT-2020-4804 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient input validation in the Windows remote desktop service, allowing an attacker to disclose protected information. There is no information provided about t...

PT-2020-4653 · Microsoft · Windows Msctf Server +1

Name of the Vulnerable Software and Affected Versions: Windows MSCTF Server affected versions not specified Description: The issue exists due to insufficient input validation in the Windows MSCTF Server component of the Windows operating system. Exploitation of this issue may allow an attacker to...

PT-2020-5011 · Adobe · Acrobat Reader For Android

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader for Android version 20.6.2 and earlier Description: The issue is related to inadequate access control, which could result in the disclosure of sensitive information stored in databases used by the application. Exploitatio...

PT-2020-4822 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Microsoft Defender for Endpoint affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to exploit it and potentially disclose...

PT-2020-4885 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint affected versions not specified Description: The issue is related to insufficient input validation in Microsoft SharePoint, which can be exploited by a remote attacker to disclose protected information. Recommendations: A...

CVE-2020-24400

CVE-2020-24400 affects Magento Open Source/Magento variants prior to fixed versions, specifically Magento 2.4.0, 2.3.5 and earlier. The vulnerability is an SQL injection that can lead to sensitive information disclosure . Exploitation requirements: an authenticated user with permissions to the pr...

libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-data.c

In exifdatasavedataentry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0...