GHSA-9X4C-63PF-525F openapi-python-client Arbitrary Code Generation vulnerability

Impact Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. Giving this a CVSS of 8.0 high with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C . Patches Fix will be...

The vulnerability of the Windows Media Foundation component in Windows operating systems allows attackers to install programs, view, modify, or delete data with the privileges of a legitimate user.

The vulnerability of the Windows Media Foundation component in Windows operating systems arises from operations that occur outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to install programs, view, modify, or delete data with the privileges of a legitimate use...

CVE-2020-1577

An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. There are multiple ways an attacker could exploit the...

CVE-2020-1492

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

CVE-2020-1380

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully...

Incorrect Authentication Vulnerability in Multiple Huawei Products

Huawei Mate 20, Mate 20 Pro, Mate 20 X, and Mate 20 RS are a smartphone from Chinese company Huawei Huawei. A security vulnerability exists in several Huawei products, which stems from the program's failure to properly sign encrypted files. An attacker could use the vulnerability to forge documen...

PT-2020-5564 · Artifex +7 · Ghostscript +7

Name of the Vulnerable Software and Affected Versions: GhostScript versions 9.50 Description: A buffer overflow issue in the okiibm print page1 function in devices/gdevokii.c allows a remote attacker to cause a denial of service via a crafted PDF file. Recommendations: For GhostScript version 9.5...

Adobe Acrobat Pro DC Web2PDF:AppLinks JavaScript Restrictions Bypass Vulnerability

This vulnerability allows remote attackers to bypass JavaScript API restrictions on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within a...

PT-2020-3710 · Microsoft · Windows Media Foundation +1

Name of the Vulnerable Software and Affected Versions: Windows Media Foundation affected versions not specified Description: The issue is caused by a memory corruption vulnerability in Windows Media Foundation, which occurs when it improperly handles objects in memory. This can be exploited by an...

Vulnerabilities fixed in Microsoft browsers

Microsoft has fixed several vulnerabilities in Internet Explorer and Edge. All of the vulnerabilities allow a malicious person to able to execute arbitrary code in the context of the user when he manages to trick the user into opening a malicious Web site or document to open. Below is an overview...

PT-2020-3656 · Microsoft · Windows Media Foundation +1

Name of the Vulnerable Software and Affected Versions: Windows Media Foundation affected versions not specified Description: A memory corruption issue exists due to improper handling of objects in memory by Windows Media Foundation. This can be exploited by an attacker to install programs, view,...

Debian DLA-2316-1 : ruby-kramdown security update

ruby-kramdown processes the template option inside Kramdown documents by default, which allows unintended read access such as template='/etc/passwd' or unintended embedded Ruby code execution such as a string that begins with template='string://%= . NOTE: kramdown is used in Jekyll, GitLab Pages,...

PT-2020-3943 · Microsoft · Windows Gdi +1

Name of the Vulnerable Software and Affected Versions: Windows GDI component affected versions not specified Description: An information disclosure issue exists due to the improper handling of memory contents by the Windows GDI component. This could allow an attacker to obtain information that...

PT-2020-3942 · Microsoft · Windows Gdi +1

Name of the Vulnerable Software and Affected Versions: Windows GDI affected versions not specified Description: The issue is related to the improper handling of objects in memory by the Windows GDI component, which can lead to information disclosure. An attacker could exploit this by convincing a...

Libre Office Multiple Vulnerabilities (Jun 2020) - Mac OS X

Libre Office is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Libre Office Multiple Vulnerabilities (Jun 2020) - Linux

Libre Office is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:libreoffice:libreoffice";...

ReportLab: Arbitrary code execution

Background ReportLab is an Open Source Python library for generating PDFs and graphics. Description ReportLab was found to be mishandling XML documents and may evaluate the contents without checking for their safety. Impact A remote attacker could possibly execute arbitrary code with the privileg...

Debian DLA-2287-1 : poppler security update

Several issues were found in Poppler, a PDF rendering library, that could lead to denial of service or possibly other unspecified impact when processing maliciously crafted documents. For Debian 9 stretch, these problems have been fixed in version 0.48.0-2+deb9u3. We recommend that you upgrade yo...

GLSA-202007-35 : ReportLab: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202007-35 ReportLab: Arbitrary code execution ReportLab was found to be mishandling XML documents and may evaluate the contents without checking for their safety. Impact : A remote attacker could possibly execute arbitrary code wi...

CVE-2020-14001

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...