SAP Fiori Launchpad Cross-Site Scripting Vulnerability

SAP Fiori is SAP's user experience UX design system for SAP applications, which provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, providing a consistent, innovative experience for creators and users.SAP Fiori Launchpad is the SA...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

Cross site scripting

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile (News tile Application) suffers a Reflected XSS in versions 750–755 due to insufficient encoding of user-controlled inputs, enabling an unauthenticated attacker to send malicious code that can be read and potentially modified in the victim’s browser. Impact per recor...

PT-2020-16510

Name of the Vulnerable Software and Affected Versions SAP Fiori Launchpad News tile Application versions 750 through 755 Description The issue allows an unauthorized attacker to send malicious code to a different end user victim using the SAP Fiori Launchpad News tile Application. This is due to...

CVE-2020-26825: Improper Neutralization of Input During Web Page Generation

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26815

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

CVE-2020-26815

CVE-2020-26815 concerns SAP Fiori Launchpad News tile Application, affected in versions 750–755. The connected sources describe a Server-Side Request Forgery (SSRF) vulnerability where an unauthenticated attacker can send a crafted request to a vulnerable web application, potentially exposing sen...

PT-2020-16500

Name of the Vulnerable Software and Affected Versions SAP Fiori Launchpad News tile Application versions 750,751,752,753,754,755 Description The issue allows an unauthorized attacker to send a crafted request to a vulnerable web application, typically used to target internal systems behind...

CVE-2020-26815: Server-Side Request Forgery (SSRF)

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

grok:grk_decompress_fuzzer: Use-of-uninitialized-value in grk::mct::decompress_irrev

Detailed Report: https://oss-fuzz.com/testcase?key=4742584414765056 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: grk::mct::decompressirrev...

PT-2020-5887 · Openexr +5 · Openexr +5

Name of the Vulnerable Software and Affected Versions: OpenEXR versions prior to 3.0.0-beta Description: The issue is related to a flaw in OpenEXR's deep tile sample size calculations, which can lead to an integer overflow and subsequently an out-of-bounds read when a crafted file is processed...

PT-2020-6260 · Openexr +5 · Openexr +5

Name of the Vulnerable Software and Affected Versions: OpenEXR version 2.3.0 Description: A head-based buffer overflow exists in the writeTileData function of OpenEXR that can cause a denial of service via a crafted EXR file. This issue is related to writing beyond the boundaries of a buffer...

OpenEXR: std:: vector out-of-bounds read and write in ImfTileOffsets.cpp

An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp...

CVE-2020-1159

An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker...

CVE-2020-1119

An information disclosure vulnerability exists when StartTileData.dll improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log on to...

PT-2020-6859 · Openexr +3 · Openexr +3

Name of the Vulnerable Software and Affected Versions: OpenEXR affected versions not specified Description: A flaw found in the dataWindowForTile function of IlmImf/ImfTiledMisc.cpp can trigger an integer overflow when a crafted file is processed, leading to an out-of-bounds write on the heap. Th...

PT-2020-3900 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: An elevation of privilege issue exists due to the way StartTileData.dll handles file creation in protected locations. This could allow an attacker to execute code with elevated permissions ...