PT-2020-3460

Name of the Vulnerable Software and Affected Versions PeopleSoft Enterprise HRMS version 9.2 Description The issue is related to inadequate access control in the Time and Labor component of Oracle PeopleSoft Enterprise HRMS. It allows a low-privileged attacker with network access via HTTP to...

PT-2020-3446

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Session Border Controller versions 8.1.0 through 8.3.0 Description The issue is related to the File Upload component and can be exploited by a high-privileged attacker with network access via HTTP. Successful attacks require...

PT-2020-3461

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Portal versions 12.2.1.3.0 through 12.2.1.4.0 Description The issue is related to insufficient access control in the Composer component of Oracle WebCenter Portal, allowing a remote attacker to modify, add, or delete data, or...

PDF Reader Buffer Overflow Unauthorized Access

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can...

Linux STIBP Unauthorized Access

The vulnerability of the Linux operating system’s kernel implementation of the Single Thread Indirect Branch Predictors STIBP technology is related to insufficient input data validation and incorrect implementation of functions. Exploiting this vulnerability can allow an attacker to gain...

PT-2020-14298

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.24 Description The issue allows a user to perform an XML External Entity XXE attack using the provided SDL style. This can be exploited by manipulating the XML input to access unauthorized data or disrupt...

CVE-2020-5583

Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to obtain unauthorized Multi-Report's data via unspecified vectors...

CVE-2020-5583

CVE-2020-5583 affects Cybozu Garoon 4.0.0 to 5.0.1. The vulnerability allows remote authenticated attackers to bypass access restrictions and obtain unauthorized Multi-Report data via unspecified vectors, effectively bypassing view privileges for that data. Impact is limited to exposure of Multi-...

PT-2020-18557

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.0.0 through 5.0.1 Description The issue allows remote authenticated attackers to bypass access restrictions and obtain unauthorized Multi-Report's data. The exact vectors used for the bypass are not specified...

GetInstalledPackages function in the Data Compromise

The vulnerability of the GetInstalledPackages function in the Application Lifestyle Management installation manager is related to the lack of mechanisms for privilege control and access management. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential...

OpenOffice.org vclmi.dll Vulnerable

The vulnerability of the vclmi.dll component in the OpenOffice.org suite of office programs for LibreOffice is related to numerical processing errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service failures, or compromise data...

LibreOffice docmacromode.cxx Heap Buffer Overflow DoS

The vulnerability of the doc/docmacromode.cxx component in the LibreOffice office software package is related to a deficiency in the processing of macros. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service failures, or compromise th...

SaltStack modules/serverdensity_device.py Data Compromise

The vulnerability in the modules/serverdensitydevice.py module of the Configuration Management system and SaltStack’s remote execution feature is related to a data processing error. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service...

Installation Manager IBM consoleinst.sh Data Compromise

The vulnerability of the consoleinst.sh component of the Installation Manager IBM is related to privilege management errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential data, cause service failures, or compromise data integrity...

CVE-2019-13033

In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be used to upload data to a central Lynis server. Although no data can be extracted by knowing the license key, it may be possible to upload th...

Huawei mobile phone Unauthorized Access

The vulnerability of Huawei’s mobile phone microprogramming software is related to security mechanism errors. Exploiting this vulnerability can allow a hacker to gain unauthorized access to protected data...

PT-2020-13771

Name of the Vulnerable Software and Affected Versions Pengutronix Barebox versions prior to v2020.05.0 Description The issue is related to an out-of-bounds read in the nfs read reply function located in net/nfs.c. This occurs because a field from an incoming network packet is used directly as a...

PeopleSoft Enterprise PeopleTools Query Component Unauthorized Access

The vulnerability of the Query component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to remotely cause service interruptions or gain unauthorized access to protected...

keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks...

Oracle Hyperion Financial Reporting Web Based Report Designer Unauthorized Access

The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application for automating budget management processes is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protect...