1305 matches found
CVE-2020-14592
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Rich Text Editor. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
CVE-2020-14592
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Rich Text Editor. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
Code injection
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Rich Text Editor. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
CVE-2020-14592
The CVE-2020-14592 entry concerns Oracle PeopleSoft Enterprise PeopleTools Rich Text Editor. Affected versions are 8.56, 8.57, and 8.58. The vulnerability is exploitable by an unauthenticated attacker over HTTP with network access, and successful exploitation requires user interaction. Impact inc...
CVE-2020-14592
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Rich Text Editor. Supported versions that are affected are 8.56, 8.57 and 8.58. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
The vulnerability of the oowriter text editor in the OpenOffice office suite allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service interruptions.
The vulnerability of the oowriter text editor within the OpenOffice office package is related to a memory management flaw after memory is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions using...
Pegasystem PEGA Platform Richtext Editor Cross-Site Scripting Vulnerability
Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem in the UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real-time Decision Making and CRM Customer Relationship Management.Richtext Editor is one of the...
CVE-2020-7958
An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...
Update for RichTextBox controls and ALT codes in Windows 8.1
Update for RichTextBox controls and ALT codes in Windows 8.1 Summary This update fixes the following issues: You have a RichTextBox control in a Windows-based application in Windows 8.1. When you try to check the spelling within the control, the application crashes in the Msftedit.dll file. When...
VMware Fusion USB Arbitrator Setuid Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMware Fusion USB Arbitrator Setuid Privilege Escalation', 'Description' = %q This exploits an improper use of setuid binaries within VMware Fusi...
VMware Fusion USB Arbitrator Setuid Privilege Escalation Exploit
This Metasploit module exploits an improper use of setuid binaries within VMware Fusion versions 10.1.3 through 11.5.3. The Open VMware USB Arbitrator Service can be launched outside of its standard path which allows loading of an attacker controlled binary. By creating a payload in the user home...
Coronavirus Bitcoin scam promises “millions” working from home
In the last week, we’ve seen multiple coronavirus scams pushed by bad actors, including RAT attacks via fake health advisories, bogus e-books working in tandem with Trojans, and lots of other phishing shenanigans. Now we have another one to add to the ever-growing list: dubious coronavirus Bitcoi...
Samsung Mobile Device Input Validation Error Vulnerability (CNVD-2020-29858)
Android is a free and open source operating system from Google based on the Linux kernel without GNU components. An input validation error vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to bypass FRP via an RCS call...
CVE-2019-20552
An issue was discovered on Samsung mobile devices with P9.0 software. Attackers can bypass Factory Reset Protection FRP via an RCS call. The Samsung ID is SVE-2019-15035 October 2019...
Coronavirus-Themed APT Attack Spreads Malware
An advanced persistent threat APT group is leveraging the coronavirus pandemic to infect victims with a previously unknown malware, in a recently discovered campaign that researchers call “Vicious Panda.” Researchers identified two suspicious Rich Text Format files RTF — a text file format used b...
PT-2020-20298 · Bludit · Bludit
Name of the Vulnerable Software and Affected Versions: Bludit version 3.10.0 Description: The issue allows users with Editor or Author roles to insert malicious JavaScript into the WYSIWYG editor. It's noted that the vendor considers this behavior as "not a bug". Recommendations: For Bludit versi...
CVE-2020-5528
Cross-site scripting vulnerability in Movable Type series Movable Type 7 r.4603 and earlier Movable Type 7, Movable Type 6.5.2 and earlier Movable Type 6.5, Movable Type Advanced 7 r.4603 and earlier Movable Type Advanced 7, Movable Type Advanced 6.5.2 and earlier Movable Type Advanced 6.5, Movab...
Movable Type vulnerable to cross-site scripting
Overview Movable Type provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79 in block editor and rich text editor. Six Apart Ltd. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Six Apart Ltd. coordinated under the...
WhatsApp Bug Allows Malicious Code-Injection, One-Click RCE
Security researchers have identified a JavaScript vulnerability in the WhatsApp desktop platform that could allow cybercriminals to spread malware, phishing or ransomware campaigns through notification messages that appear completely normal to unsuspecting users. And, further investigation shows...
