CVE-2020-6281

CVE-2020-6281 affects SAP Business Objects Business Intelligence Platform (BI Launchpad) v4.2. The issue is insufficient encoding of user-controlled inputs, leading to reflected cross-site scripting. The connected documents consistently describe a client-side data validation/encoding problem in B...

Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64

The Mozilla Foundation Security Advisory describes this flaw as: Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash...

Windows Runtime Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted...

Windows SharedStream Library Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that the SharedStream Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker could run a...

Microsoft Graphics Components Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system. To exploit the vulnerability, a user would have to open a specially crafte...

Windows Runtime Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted...

Microsoft Graphics Component Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. An authenticated attacker could exploit this...

Microsoft Word Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the...

Microsoft Word Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the...

Windows Network Connections Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker...

Windows Print Workflow Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Print Workflow Service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could gain elevated privileges and break out of the AppContainer sandbox. To exploit this vulnerability, an attack...

Windows Runtime Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context. An attacker could exploit this vulnerability by running a specially crafted...

PT-2020-13727

Name of the Vulnerable Software and Affected Versions Sylabs Singularity versions 3.5.0 through 3.5.3 Description The issue arises when the --all / -a option is used with singularity verify, as it returns a success message even if some objects in a SIF container are not signed or cannot be...

PT-2020-19070

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform BI Launchpad and CMC versions 4.1, 4.2 Description The issue allows an attacker to embed malicious scripts in the application while uploading images. These scripts get executed when the victi...

CVE-2020-6278: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform BI Launchpad and CMC, versions 4.1, 4.2, allows to an attacker to embed malicious scripts in the application while uploading images, which gets executed when the victim opens these files, leading to Stored Cross Site Scripting...

CVE-2020-1368: Undefined Security Weakness

An elevation of privilege vulnerability exists in the way that the Credential Enrollment Manager service handles objects in memory, aka 'Windows Credential Enrollment Manager Service Elevation of Privilege Vulnerability'...

PT-2020-3079

Name of the Vulnerable Software and Affected Versions Microsoft Excel affected versions not specified Description A remote code execution issue exists in Microsoft Excel software due to improper handling of objects in memory. This can allow a remote attacker to execute arbitrary code...

CVE-2020-1438: Undefined Security Weakness

An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connections Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1373, CVE-2020-1390, CVE-2020-1427, CVE-2020-1428...

CVE-2020-1428: Undefined Security Weakness

An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connections Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1373, CVE-2020-1390, CVE-2020-1427, CVE-2020-1438...

CVE-2020-6276: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform bipodata, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...