CVE-2020-6218

The CVE-2020-6218 entry concerns SAP Business Objects Business Intelligence Platform, with vulnerable components/areas in Admin tools and Query Builder. Affected versions are 4.1 and 4.2. The description indicates an information disclosure risk where an attacker can access information that should...

Security Bulletin: IBM QRadar SIEM is vulnerable to instantiation of arbitrary objects (CVE-2020-4272)

Summary IBM QRadar SIEM is vulnerable to vulnerable to instantiation of arbitrary objects based on user-supplied input. Vulnerability Details CVEID: CVE-2020-4272 DESCRIPTION: IBM QRadar could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted...

Windows Push Notification Service Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows Push Notification Service improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. An authenticated attacker could exploit this...

Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or...

Media Foundation Information Disclosure Vulnerability

An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log onto ...

Windows Kernel Information Disclosure Vulnerability

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on ...

Win32k Information Disclosure Vulnerability

An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log ...

PT-2020-2286

Name of the Vulnerable Software and Affected Versions Internet Explorer affected versions not specified Description A remote code execution issue exists due to the way the VBScript engine handles objects in memory. This could allow an attacker to execute arbitrary code in the context of the curre...

CVE-2020-6195: Cleartext Transmission of Sensitive Information

SAP Business Objects Business Intelligence Platform CMC, version 4.1, 4.2, shows cleartext password in the response, leading to Information Disclosure. It involves social engineering in order to gain access to system and If password is known, it would give administrative rights to the attacker to...

Security Updates for Microsoft Excel Products (April 2020)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries. An attacker could then install programs; view, change, or delete data...

CVE-2020-6216: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform BI Launchpad, version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting XSS vulnerability...

CVE-2020-6219: Deserialization of Untrusted Data

SAP Business Objects Business Intelligence Platform CrystalReports WebForm Viewer, versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service a...

CVE-2020-6222: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2020-6221: Improper Neutralization of Input During Web Page Generation

Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2020-6218: Undefined Security Weakness

Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access information that should otherwise be restricted, leading to Information Disclosure...

CVE-2020-6226: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2020-6231: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2020-6211: URL Redirection to Untrusted Site

SAP Business Objects Business Intelligence Platform AdminTools, versions 4.1, 4.2, allows an attacker to redirect users to a malicious site due to insufficient URL validation and steal credentials of the victim, leading to URL Redirection vulnerability...

CVE-2020-6227: Improper Input Validation

SAP Business Objects Business Intelligence Platform CMS / Auditing issues, version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files...

PT-2020-2248

Name of the Vulnerable Software and Affected Versions Windows Graphics Component affected versions not specified Description The issue is related to the improper handling of objects in memory by the Windows Graphics Component, which can lead to an elevation of privilege. This can potentially allo...