CVE-2020-28115

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

CVE-2020-28115

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

Sql injection

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

CVE-2020-28115

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

CVE-2020-28115

AudimexEE’s CVE-2020-28115 is a SQL injection in the Documents component of version 14.1.0, exploitable via the object_path parameter. Multiple connected sources corroborate: CNVD-2020-65171 states the vulnerability exists in AudimexEE versions prior to 14.1.1, implying a fixed version is 14.1.1....

Kaixin Electronic Document Inventory in Arbitrary File Download Vulnerability

Qixing electronic document library can be used to store departmental manuals, system specifications, mechanical drawings and other edoc. The Qixing Electronic Document Library is vulnerable to an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on...

Operation North Star: Behind The Scenes | McAfee Blogs

ARCHIVED STORY Operation North Star: Behind The Scenes Christiaan Beek · NOV 05, 2020 Executive Summary It is rare to be provided an inside view on how major cyber espionage campaigns are conducted within the digital realm. The only transparency afforded is a limited view of victims, a malware...

PT-2020-16928

Name of the Vulnerable Software and Affected Versions AudimexEE version 14.1.0 Description A SQL Injection issue in the Documents component allows an attacker to execute arbitrary SQL commands via the object path parameter. Recommendations For AudimexEE version 14.1.0, avoid using the object path...

Kaixin Electronic Document Inventory in File Upload Vulnerability

Qixing electronic document library can be used to store departmental manuals, system specifications, mechanical drawings and other edoc. The Qixing Electronic Document Library suffers from a file upload vulnerability, which can be exploited by an attacker to upload a malicious file and take contr...

Operation North Star: Summary Of Our Latest Analysis | McAfee Blogs

Operation North Star: Summary Of Our Latest Analysis By Trellix · NOV 05, 2020 McAfee’s Advanced Threat Research ATR today released research that uncovers previously undiscovered information on how Operation North Star evaluated its prospective victims and launched attacks on organizations in...

Operation North Star: Behind The Scenes | McAfee Blogs

ARCHIVED STORY Operation North Star: Behind The Scenes Christiaan Beek · NOV 05, 2020 Executive Summary It is rare to be provided an inside view on how major cyber espionage campaigns are conducted within the digital realm. The only transparency afforded is a limited view of victims, a malware...

CVE-2020-28115: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

poppler: divide-by-zero in function SplashOutputDev::tilingPatternFill in SplashOutputDev.cc

A divide-by-zero error was found in the way Poppler handled certain PDF files. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by an application linked to Poppler, would crash the application causing a denial of service...

libreoffice: 'stealth mode' remote resource restrictions bypass

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed...

Security Blueprints of Many Companies Leaked in Hack of Swedish Firm Gunnebo

In March 2020, KrebsOnSecurity alerted Swedish security giant Gunnebo Group that hackers had broken into its network and sold the access to a criminal group which specializes in deploying ransomware. In August, Gunnebo said it had successfully thwarted a ransomware attack, but this week it emerge...

The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop as demonstrated via a crafted DOC file.

...

PT-2020-19345 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 6.8.13 Elasticsearch versions prior to 7.9.2 Description: The issue is related to a document disclosure flaw when Document or Field Level Security is used in Elasticsearch. Search queries do not properly preser...

Facebook WhatsApp Resource Management Error Vulnerability

Facebook WhatsApp is a suite of mobile applications from Facebook Inc. in the United States that use the Internet to send text messages. The application uses the contact information in a smartphone to find contacts using the program to send texts, pictures, etc. WhatsApp Business is the commercia...

CVE-2020-27605

BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."...

CVE-2020-27605: Undefined Security Weakness

BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."...