Hyland OnBase Directory Traversal Vulnerability (CNVD-2020-51794)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to write to a file via the FileName parameter...

Hyland OnBase XML Deserialization Library Insecure Use Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase is vulnerable to an unsafe use of the XML deserialization library. No detailed vulnerability details are provided at this time...

Hyland OnBase Denial of Service Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a denial of service vulnerability that can be exploited by an attacker to cause a denial of service via a long user ID...

Hyland OnBase XXE Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from an XXE vulnerability that can be exploited by an attacker to gain read/write access to arbitrary files...

Hyland OnBase Cross-Site Request Forgery Vulnerability (CNVD-2020-52044)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. A cross-site request forgery vulnerability exists in Hyland OnBase. The vulnerability stems from the presence of default credentials. An attacker could exploit the vulnerability to enable user logi...

CVE-2020-25253: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by the TableName, ColumnName, Name, UserId, or Password parameter...

CVE-2020-25260: Deserialization of Untrusted Data

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows remote attackers to execute arbitrary code because of unsafe JSON deserialization...

Hyland OnBase Directory Traversal Vulnerability

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a directory traversal vulnerability. An attacker can exploit this vulnerability to read a file via the FileName parameter...

CVE-2020-25259: Deserialization of Untrusted Data

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses XML deserialization libraries in an unsafe manner...

PT-2020-16033 · Hyland · Onbase

Name of the Vulnerable Software and Affected Versions: Hyland OnBase versions prior to 18.0.0.33 and versions 19.x through 19.8.9.1000 Description: An issue exists where directory traversal is possible, allowing writing to files. This is demonstrated through the FileName parameter. Recommendation...

Hyland OnBase SQL Injection Vulnerability (CNVD-2020-52045)

Hyland OnBase is an enterprise information platform for managing your content, processes and cases. Hyland OnBase suffers from a SQL injection vulnerability. The vulnerability can be exploited by an attacker to conduct a SQL injection attack via the TableName, ColumnName, Name, UserId, or Passwor...

CVE-2020-25251: Improper Authentication

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client-side authentication is used for critical functions such as adding users or retrieving sensitive information...

CVE-2020-25254: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by TestConnectionLocalOrLinkedServer, CreateFilterFriendlyView, or AddWorkViewLinkedServer...

CVE-2020-25257: Improper Restriction of XML External Entity Reference

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files...

CVE-2020-25258: Deserialization of Untrusted Data

An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses ASP.NET BinaryFormatter.Deserialize in a manner that allows attackers to transmit and execute bytecode in SOAP messages...

CVE-2020-25247: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for writing to files, as demonstrated by the FileName parameter...

Hyland OnBase SQL Injection

CVSSv3.1 Score ------------------------------------------------- AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Vendor ------------------------------------------------- Hyland Software - https://www.hyland.com/en/ and https://www.onbase.com/en/ Product ------------------------------------------------- Hylan...

Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers

Overview Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers. These vulnerabilities could allow a remote attacker to execute arbitrary code on an affected system. Description Autonomy Keyview IDOL is a set of libraries that can decode over 1,000 different file formats. The...

PT-2025-33029

Name of the Vulnerable Software and Affected Versions: Hyland OnBase versions prior to 17.0.2.87 Description: Hyland OnBase is vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the...