PT-2020-5564 · Artifex +7 · Ghostscript +7

Name of the Vulnerable Software and Affected Versions: GhostScript versions 9.50 Description: A buffer overflow issue in the okiibm print page1 function in devices/gdevokii.c allows a remote attacker to cause a denial of service via a crafted PDF file. Recommendations: For GhostScript version 9.5...

Incorrect Authentication Vulnerability in Multiple Huawei Products

Huawei Mate 20, Mate 20 Pro, Mate 20 X, and Mate 20 RS are a smartphone from Chinese company Huawei Huawei. A security vulnerability exists in several Huawei products, which stems from the program's failure to properly sign encrypted files. An attacker could use the vulnerability to forge documen...

Adobe Acrobat Pro DC Web2PDF:AppLinks JavaScript Restrictions Bypass Vulnerability

This vulnerability allows remote attackers to bypass JavaScript API restrictions on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within a...

PT-2020-3710 · Microsoft · Windows Media Foundation +1

Name of the Vulnerable Software and Affected Versions: Windows Media Foundation affected versions not specified Description: The issue is caused by a memory corruption vulnerability in Windows Media Foundation, which occurs when it improperly handles objects in memory. This can be exploited by an...

PT-2020-3656 · Microsoft · Windows Media Foundation +1

Name of the Vulnerable Software and Affected Versions: Windows Media Foundation affected versions not specified Description: A memory corruption issue exists due to improper handling of objects in memory by Windows Media Foundation. This can be exploited by an attacker to install programs, view,...

Vulnerabilities fixed in Microsoft browsers

Microsoft has fixed several vulnerabilities in Internet Explorer and Edge. All of the vulnerabilities allow a malicious person to able to execute arbitrary code in the context of the user when he manages to trick the user into opening a malicious Web site or document to open. Below is an overview...

Debian DLA-2316-1 : ruby-kramdown security update

ruby-kramdown processes the template option inside Kramdown documents by default, which allows unintended read access such as template='/etc/passwd' or unintended embedded Ruby code execution such as a string that begins with template='string://%= . NOTE: kramdown is used in Jekyll, GitLab Pages,...

PT-2020-3943 · Microsoft · Windows Gdi +1

Name of the Vulnerable Software and Affected Versions: Windows GDI component affected versions not specified Description: An information disclosure issue exists due to the improper handling of memory contents by the Windows GDI component. This could allow an attacker to obtain information that...

PT-2020-3942 · Microsoft · Windows Gdi +1

Name of the Vulnerable Software and Affected Versions: Windows GDI affected versions not specified Description: The issue is related to the improper handling of objects in memory by the Windows GDI component, which can lead to information disclosure. An attacker could exploit this by convincing a...

Libre Office Multiple Vulnerabilities (Jun 2020) - Linux

Libre Office is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:libreoffice:libreoffice";...

Libre Office Multiple Vulnerabilities (Jun 2020) - Mac OS X

Libre Office is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

ReportLab: Arbitrary code execution

Background ReportLab is an Open Source Python library for generating PDFs and graphics. Description ReportLab was found to be mishandling XML documents and may evaluate the contents without checking for their safety. Impact A remote attacker could possibly execute arbitrary code with the privileg...

Debian DLA-2287-1 : poppler security update

Several issues were found in Poppler, a PDF rendering library, that could lead to denial of service or possibly other unspecified impact when processing maliciously crafted documents. For Debian 9 stretch, these problems have been fixed in version 0.48.0-2+deb9u3. We recommend that you upgrade yo...

GLSA-202007-35 : ReportLab: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202007-35 ReportLab: Arbitrary code execution ReportLab was found to be mishandling XML documents and may evaluate the contents without checking for their safety. Impact : A remote attacker could possibly execute arbitrary code wi...

CVE-2020-14001

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...

Vulnerability Spotlight: SQL injection vulnerability in Glacies IceHRM

Yuri Kramarz of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos researchers recently discovered that the Glacies' IceHRM software contains a vulnerability that could allow an adversary to inject SQL. IceHRM is a human resource management tool, allowing users to create...

CVE-2020-12408

When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vulnerability affects Firefox 77...

EulerOS Virtualization 3.0.6.0 : ghostscript (EulerOS-SA-2020-1738)

According to the version of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The InsMIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of servic...

Unintended read access in kramdown gem

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access such as template="/etc/passwd" or unintended embedded Ruby code execution such as a string that begins with template="string://%= . NOTE: kramdown is used...

Spyse: All-In-One Cybersecurity Search Engine

Spyse is a cybersecurity search engine for finding technical information about different internet entities, business data, and vulnerabilities. It’s an all-in-one platform for fast and effortless reconnaissance without using any additional tools. Spyse engine implements a ready-to-use database wi...