Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or...

.NET Framework Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program. The update addresses the vulnerability by...

Windows Kernel Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create ne...

CVE-2020-6242: Missing Authentication for Critical Function

SAP Business Objects Business Intelligence Platform Live Data Connect, versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on the Central Management Console without password in case of the BIPRWS application server was not protected with some specific certificate, leading to Missing...

CVE-2020-6257: Improper Neutralization of Input During Web Page Generation

SAP Business Objects Business Intelligence Platform CMC and BI Launchpad 4.2 does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability...

CVE-2020-6245: Improper Control of Resource Identifiers

SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code that can be executed by the application due to Improper Control of Resource Identifiers...

CVE-2020-6247: Undefined Security Weakness

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessing a service. Using a specially crafted request, the attacker can crash or flood the Central Management Server, thereby impacting system availability...

CVE-2020-6251: Undefined Security Weakness

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access information which would otherwise be restricted...

PT-2020-2817

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to an elevation of privilege vulnerability in DirectX, which occurs due to improper handling of objects in memory. This could allow an attacker to elevate their privilege...

PT-2020-2823

Name of the Vulnerable Software and Affected Versions Windows Push Notification Service affected versions not specified Description The issue is related to an elevation of privilege vulnerability in the way the Windows Push Notification Service handles objects in memory. This vulnerability can be...

PT-2020-12579

Name of the Vulnerable Software and Affected Versions Windows Client Server Run-Time Subsystem CSRSS affected versions not specified Description An information disclosure issue exists due to the improper handling of objects in memory by the Windows Client Server Run-Time Subsystem CSRSS. This...

PT-2020-19043

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an unauthenticated attacker to prevent legitimate users from accessing a service by crashing or flooding the Central Management Server, thereby...

PT-2020-19047

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an attacker to access restricted information under certain conditions or error scenarios. Recommendations For SAP Business Objects Business Intelligen...

PT-2020-19041

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform version 4.2 Description The issue allows an attacker with access to a local instance to inject files or code that can be executed by the application due to improper control of resource...

PT-2020-2455

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to the Graphics Device Interface GDI component of the Windows operating system and is associated with insecure privilege management. It may allow an attacker to elevate...

PT-2020-2519

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A remote code execution issue exists in the way Windows handles objects in memory. This allows remote attackers to execute arbitrary code and affect the system. Recommendations At the moment,...

PT-2020-19052

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform CMC and BI Launchpad version 4.2 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a Cross-Site Scripting issue. Recommendations For SAP Busine...

PT-2020-2521

Name of the Vulnerable Software and Affected Versions Windows versions prior to 10.0.18363 Description An elevation of privilege issue exists due to the Windows kernel-mode driver's failure to properly handle objects in memory. This allows an attacker to potentially elevate their privileges. The...

(Pwn2Own) Adobe Acrobat Reader DC Field Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Adobe Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Field...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...