CVE-2020-13532

A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to escalate privileges to NT SYSTEM. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2020-13533

Dream Report 5 R20-2 is affected by a privilege escalation vulnerability linked to default weak permissions in the install directory and specific Run keys. The default C:\ODS permissions allow broad access, enabling an attacker to abuse Run keys ods_rtm_launch and ods_usc (mapping to RTM.exe and ...

CVE-2020-13533

A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can be abused by attackers to effectively ‘backdoor’ the installation files and escalate privileges when a new user logs...

CVE-2020-13534

Dream Report 5 R20-2 is affected by CVE-2020-13534, a privilege-escalation vulnerability. The root cause is weak default permissions in components installed by Dream Report (notably COM CLSIDs referencing LocalServer32 and InprocServer32 in the Dream Report System directory C:\ODS). A specially c...

CVE-2020-13534

A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers CLSID, installed by Dream Report 5 20-2, reference LocalServer32 and InprocServer32 with weak privileges which can lead to privilege escalation when used. An attacker can provide a malicious file to trigger...

Dream Report platform privilege escalation vulnerability

Summary Multiple privilege escalation vulnerabilities exist in Dream Report 5 R20-2. A specially crafted executable can cause elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions Dream Report 5 R20-2 Product URLs https://dreamreport.net/...

Ocean Data Systems Dream Report 5 R20-2 安全漏洞

Ocean Data Systems Dream Report 5 R20-2 is an application from the French company Ocean Data Systems. A real-time reporting and charting solution. A security vulnerability exists in Dream Report 5 R20-2, which can be triggered by an attacker providing a malicious file...

Ocean Data Systems Dream Report 5 R20-2 安全漏洞

Ocean Data Systems Dream Report 5 R20-2 is an application from the French company Ocean Data Systems. A real-time reporting and charting solution. Dream Report 5 R20-2 suffers from a security vulnerability that allows an attacker to misuse registry entries which refer to weakly-privileged binarie...

Ocean Data Systems Dream Report 5 R20-2 安全漏洞

Ocean Data Systems Dream Report 5 R20-2 is an application from the French company Ocean Data Systems. A real-time reporting and charting solution. Dream Report 5 R20-2 has a security vulnerability that allows an attacker to replace the Syncfusion Dashboard Service service binary to escalate...

Arbitrary File Deletion Vulnerability in Dream CMS

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. Dream CMS has an arbitrary file deletion vulnerability that can be exploited by an attacker to compromise integrity...

Authorities Take Down World's Largest Illegal Dark Web Marketplace

Europol on Tuesday said it shut down DarkMarket, the world's largest online marketplace for illicit goods, as part of an international operation involving Germany, Australia, Denmark, Moldova, Ukraine, the U.K.'s National Crime Agency NCA, and the U.S. Federal Bureau of Investigation FBI. At the...

Hacked Security Software Used in Novel South Korean Supply-Chain Attack

The Lazarus cybercriminal group is using a novel supply-chain attack against visitors to websites operated by the South Korean government and financial firms, in order to deliver dropper malware that eventually plants a remote access trojan on victim’s PCs. The attacks use stolen digital...

SQL Injection Vulnerability in Dream CMS Backend Theme Management Service

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. A SQL injection vulnerability exists in the backend topic management system of Dream CMS. Attackers can use the vulnerability to obtain sensitive information in the database...

SQL Injection Vulnerability in Advertisement Modification of Dream CMS Backend

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. A SQL injection vulnerability exists in the background advertisement modification of Dream CMS. Attackers can use the vulnerability to obtain sensitive database information...

Arbitrary File Deletion Vulnerability in Fi***.cl***.php File in Dream CMS Backend

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. Dream CMS background Fi.cl.php file exists arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete arbitrary files on the server...

SQL Injection Vulnerability in Bo***.cl***.php File in Dream CMS Backend

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. A SQL injection vulnerability exists in the Bo.cl.php file in the background of Dream CMS. Attackers can use the vulnerability to obtain database sensitive information...

SQL Injection Vulnerability in Dream CMS Backend Sq***.cl***.php File

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. Dream CMS background Sq.cl.php file SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive database information...

Arbitrary file deletion vulnerability in the Ba***.cl***.php file in the background of Dream CMS

Dream CMS lmxcms is developed using php language and mysql database, and adopts the mainstream MVC design model. Dream CMS background Ba.cl.php file exists arbitrary file deletion vulnerability. An attacker can exploit the vulnerability to delete any file on the server...

clinic.e-dream.co.kr Cross Site Scripting vulnerability OBB-1344408

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

florida-dream-villa.de Cross Site Scripting vulnerability OBB-1335840

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...