{"vulnerability": "cve-2020-3593", "sightings": [{"uuid": "4ba15d29-7cc0-4a54-8815-1b9f9b2dcb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35932", "type": "seen", "source": "https://t.me/cibsecurity/21493", "content": "\u203c CVE-2020-35932 \u203c\n\nInsecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:34.000000Z"}, {"uuid": "11cc6399-6047-491c-a38c-90f1c6e96884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35930", "type": "seen", "source": "https://t.me/cibsecurity/21482", "content": "\u203c CVE-2020-35930 \u203c\n\nSeo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-31T22:31:49.000000Z"}, {"uuid": "73d43de2-0a5e-4203-821e-a6f91e3ed5d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35935", "type": "seen", "source": "https://t.me/cibsecurity/21500", "content": "\u203c CVE-2020-35935 \u203c\n\nThe Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:43.000000Z"}, {"uuid": "09a5de6b-be54-4222-8e87-da2f3edccc2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35939", "type": "seen", "source": "https://t.me/cibsecurity/21498", "content": "\u203c CVE-2020-35939 \u203c\n\nPHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:41.000000Z"}, {"uuid": "4b7644b1-5ab9-4092-b997-add15dda4e7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35931", "type": "seen", "source": "https://t.me/cibsecurity/21484", "content": "\u203c CVE-2020-35931 \u203c\n\nAn issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and before 4.1.1 on macOS). An attacker can spoof a certified PDF document via an Evil Annotation Attack because the products fail to consider a null value for a Subtype entry of the Annotation dictionary, in an incremental update.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T00:31:54.000000Z"}, {"uuid": "1a99815a-b6c3-4877-a3a9-6484192c546f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35938", "type": "seen", "source": "https://t.me/cibsecurity/21499", "content": "\u203c CVE-2020-35938 \u203c\n\nPHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:42.000000Z"}, {"uuid": "660d93f9-3e62-4c07-abb2-e0a2043d8fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35933", "type": "seen", "source": "https://t.me/cibsecurity/21497", "content": "\u203c CVE-2020-35933 \u203c\n\nA Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:40.000000Z"}, {"uuid": "2c3008e6-18c6-4859-9f80-f330453c494d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35937", "type": "seen", "source": "https://t.me/cibsecurity/21492", "content": "\u203c CVE-2020-35937 \u203c\n\nStored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:33.000000Z"}, {"uuid": "79cd8ddd-54f8-4ef9-9442-9b945ed9e8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35936", "type": "seen", "source": "https://t.me/cibsecurity/21491", "content": "\u203c CVE-2020-35936 \u203c\n\nStored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-01T07:32:31.000000Z"}, {"uuid": "07c85efb-c2f9-452e-a29f-5183b20385d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3593", "type": "seen", "source": "https://t.me/cibsecurity/16016", "content": "\u203c CVE-2020-3593 \u203c\n\nA vulnerability in Cisco SD-WAN Software could allow an authenticated, local attacker to elevate privileges to root on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted request to a utility that is running on an affected system. A successful exploit could allow the attacker to gain root privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-11-06T22:51:36.000000Z"}, {"uuid": "91beccf5-bb3c-4d03-bf1e-1def716c3e17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35931", "type": "seen", "source": "https://t.me/hacking_Attack/10387", "content": "Black Hat Ethical Hacking\nPDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PDF Feature \u2018Certified\u2019 Widely Vulnerable to AttackPost Views: 161 \nReading Time: 1 Minute\nCertified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents\u2019 integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.\nResearchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature. Certification signatures are the more flexible and made to handle complicated agreements between multiple parties and allow some changes to the document within a set of parameters while still maintaining its validity.\n\nUnsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, \u201cEvil Annotation\u201d (EAA) and \u201cSneaky Signature\u201d (SSA). Both allow an attacker to overlay malicious content\u00a0(PDF) on top of the certified information without showing any signs it was altered. Novel Certified PDF Attacks EAAs display malicious content in the document\u2019s annotations and then sends it on with its digital signature intact. SSAs add malicious content over legitimate content in the PDF itself.\n\nThe team said the results of its evaluation of the 26 most popular PDF applications were \u201calarming.\u201d\nSee Also: Pulse Secure VPNs Get Quick Fix for Critical RCE \u201cIn only 2 cases, we could not find a vulnerability; 15 viewers were vulnerable to EAA, 8 to SSA, including Adobe, Foxit, and LibreOffice,\u201d the report said. \u201cWe additionally analyzed the standard-compliant implementation of PDF certification applications and found issues in 11 of them.\u201d\n\nAdobe had an additional flaw that allowed certified documents to execute JavaScript code, opening these users to code in injection attacks.\n\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/05/26161319/Evil-Annotation-PDF-Research_10-300x187.jpg \u201cFor example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.\n\nThe team said it disclosed their findings to the appropriate vendors and provided a comprehensive vulnerability report, including exploits, to CERT-Bund (BSI). The report also lists the specific certified PDF security flaws\u00a0found in each application.\n\n\u201cAdobe, Foxit, and LibreOffice responded quickly and provided patches for late 2020 (CVE-2020-35931) or early 2021 (CVE2021-28545, CVE-2021-28546),\u201d the report said. \u201cAdobe fixed the code injection vulnerability in early Nov. 2020 within a patch outside the regular update cycle (CVE-2020-24432). Currently, we participate in the standardization process via the German National Organization for Standardization (DIN) and the International Organization for Standardization (ISO) to address the reported attacks in the next PDF specification.\u201d\nSee Also: Offensive Security Tool: Snallygaster Stopping Certified PDF AttacksTo fend off Evil Annotation Attacks, the researchers recommend admins prohibit three particularly risky annotations that allow text or images to be added to a certified PDF, \u201cFreeText, Stamp and Redact.\u201d\n\nSneaky Signatures can be blocked by reducing permissions, but that is not a guarantee SSAs won\u2019t g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:40.928335Z"}, {"uuid": "171b0c7c-52cc-44a5-abde-d300dec51f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35931", "type": "seen", "source": "https://t.me/hacking_Attack/10387", "content": "Black Hat Ethical Hacking\nPDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PDF Feature \u2018Certified\u2019 Widely Vulnerable to AttackPost Views: 161 \nReading Time: 1 Minute\nCertified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents\u2019 integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.\nResearchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature. Certification signatures are the more flexible and made to handle complicated agreements between multiple parties and allow some changes to the document within a set of parameters while still maintaining its validity.\n\nUnsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, \u201cEvil Annotation\u201d (EAA) and \u201cSneaky Signature\u201d (SSA). Both allow an attacker to overlay malicious content\u00a0(PDF) on top of the certified information without showing any signs it was altered. Novel Certified PDF Attacks EAAs display malicious content in the document\u2019s annotations and then sends it on with its digital signature intact. SSAs add malicious content over legitimate content in the PDF itself.\n\nThe team said the results of its evaluation of the 26 most popular PDF applications were \u201calarming.\u201d\nSee Also: Pulse Secure VPNs Get Quick Fix for Critical RCE \u201cIn only 2 cases, we could not find a vulnerability; 15 viewers were vulnerable to EAA, 8 to SSA, including Adobe, Foxit, and LibreOffice,\u201d the report said. \u201cWe additionally analyzed the standard-compliant implementation of PDF certification applications and found issues in 11 of them.\u201d\n\nAdobe had an additional flaw that allowed certified documents to execute JavaScript code, opening these users to code in injection attacks.\n\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/05/26161319/Evil-Annotation-PDF-Research_10-300x187.jpg \u201cFor example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.\n\nThe team said it disclosed their findings to the appropriate vendors and provided a comprehensive vulnerability report, including exploits, to CERT-Bund (BSI). The report also lists the specific certified PDF security flaws\u00a0found in each application.\n\n\u201cAdobe, Foxit, and LibreOffice responded quickly and provided patches for late 2020 (CVE-2020-35931) or early 2021 (CVE2021-28545, CVE-2021-28546),\u201d the report said. \u201cAdobe fixed the code injection vulnerability in early Nov. 2020 within a patch outside the regular update cycle (CVE-2020-24432). Currently, we participate in the standardization process via the German National Organization for Standardization (DIN) and the International Organization for Standardization (ISO) to address the reported attacks in the next PDF specification.\u201d\nSee Also: Offensive Security Tool: Snallygaster Stopping Certified PDF AttacksTo fend off Evil Annotation Attacks, the researchers recommend admins prohibit three particularly risky annotations that allow text or images to be added to a certified PDF, \u201cFreeText, Stamp and Redact.\u201d\n\nSneaky Signatures can be blocked by reducing permissions, but that is not a guarantee SSAs won\u2019t g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:17.460968Z"}, {"uuid": "390e52ad-7891-4af8-b0d8-43813856e7b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35931", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/10387", "content": "Black Hat Ethical Hacking\nPDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PDF Feature \u2018Certified\u2019 Widely Vulnerable to AttackPost Views: 161 \nReading Time: 1 Minute\nCertified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents\u2019 integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.\nResearchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature. Certification signatures are the more flexible and made to handle complicated agreements between multiple parties and allow some changes to the document within a set of parameters while still maintaining its validity.\n\nUnsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, \u201cEvil Annotation\u201d (EAA) and \u201cSneaky Signature\u201d (SSA). Both allow an attacker to overlay malicious content\u00a0(PDF) on top of the certified information without showing any signs it was altered. Novel Certified PDF Attacks EAAs display malicious content in the document\u2019s annotations and then sends it on with its digital signature intact. SSAs add malicious content over legitimate content in the PDF itself.\n\nThe team said the results of its evaluation of the 26 most popular PDF applications were \u201calarming.\u201d\nSee Also: Pulse Secure VPNs Get Quick Fix for Critical RCE \u201cIn only 2 cases, we could not find a vulnerability; 15 viewers were vulnerable to EAA, 8 to SSA, including Adobe, Foxit, and LibreOffice,\u201d the report said. \u201cWe additionally analyzed the standard-compliant implementation of PDF certification applications and found issues in 11 of them.\u201d\n\nAdobe had an additional flaw that allowed certified documents to execute JavaScript code, opening these users to code in injection attacks.\n\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/05/26161319/Evil-Annotation-PDF-Research_10-300x187.jpg \u201cFor example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.\n\nThe team said it disclosed their findings to the appropriate vendors and provided a comprehensive vulnerability report, including exploits, to CERT-Bund (BSI). The report also lists the specific certified PDF security flaws\u00a0found in each application.\n\n\u201cAdobe, Foxit, and LibreOffice responded quickly and provided patches for late 2020 (CVE-2020-35931) or early 2021 (CVE2021-28545, CVE-2021-28546),\u201d the report said. \u201cAdobe fixed the code injection vulnerability in early Nov. 2020 within a patch outside the regular update cycle (CVE-2020-24432). Currently, we participate in the standardization process via the German National Organization for Standardization (DIN) and the International Organization for Standardization (ISO) to address the reported attacks in the next PDF specification.\u201d\nSee Also: Offensive Security Tool: Snallygaster Stopping Certified PDF AttacksTo fend off Evil Annotation Attacks, the researchers recommend admins prohibit three particularly risky annotations that allow text or images to be added to a certified PDF, \u201cFreeText, Stamp and Redact.\u201d\n\nSneaky Signatures can be blocked by reducing permissions, but that is not a guarantee SSAs won\u2019t g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T06:00:05.284616Z"}, {"uuid": "4ab40f7a-9839-494f-9818-b27951151629", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35931", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/10387", "content": "Black Hat Ethical Hacking\nPDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PDF Feature \u2018Certified\u2019 Widely Vulnerable to AttackPost Views: 161 \nReading Time: 1 Minute\nCertified portable document format (PDF) files are used to securely sign agreements between two parties while keeping the contents\u2019 integrity protected, but a new report found the security protections on most certified PDF applications were inadequate and left organizations exposed to a number of attacks.\nResearchers from Ruhr University Bochum explained certified PDFs use two specific signatures to authenticate the document, an Approval signature and a Certification signature. Certification signatures are the more flexible and made to handle complicated agreements between multiple parties and allow some changes to the document within a set of parameters while still maintaining its validity.\n\nUnsurprisingly, Certified signatures are where the team found vulnerabilities to two specific novel attacks they dubbed, \u201cEvil Annotation\u201d (EAA) and \u201cSneaky Signature\u201d (SSA). Both allow an attacker to overlay malicious content\u00a0(PDF) on top of the certified information without showing any signs it was altered. Novel Certified PDF Attacks EAAs display malicious content in the document\u2019s annotations and then sends it on with its digital signature intact. SSAs add malicious content over legitimate content in the PDF itself.\n\nThe team said the results of its evaluation of the 26 most popular PDF applications were \u201calarming.\u201d\nSee Also: Pulse Secure VPNs Get Quick Fix for Critical RCE \u201cIn only 2 cases, we could not find a vulnerability; 15 viewers were vulnerable to EAA, 8 to SSA, including Adobe, Foxit, and LibreOffice,\u201d the report said. \u201cWe additionally analyzed the standard-compliant implementation of PDF certification applications and found issues in 11 of them.\u201d\n\nAdobe had an additional flaw that allowed certified documents to execute JavaScript code, opening these users to code in injection attacks.\n\nhttps://media.threatpost.com/wp-content/uploads/sites/103/2021/05/26161319/Evil-Annotation-PDF-Research_10-300x187.jpg \u201cFor example, a high-level JavaScript can call an arbitrary URL without user confirmation to deanonymize a user. Our research reveals that such code is also executed if it is added as an allowed incremental update. We are the first to reveal that this behavior allows attackers to directly embed malicious code into a certified document.\n\nThe team said it disclosed their findings to the appropriate vendors and provided a comprehensive vulnerability report, including exploits, to CERT-Bund (BSI). The report also lists the specific certified PDF security flaws\u00a0found in each application.\n\n\u201cAdobe, Foxit, and LibreOffice responded quickly and provided patches for late 2020 (CVE-2020-35931) or early 2021 (CVE2021-28545, CVE-2021-28546),\u201d the report said. \u201cAdobe fixed the code injection vulnerability in early Nov. 2020 within a patch outside the regular update cycle (CVE-2020-24432). Currently, we participate in the standardization process via the German National Organization for Standardization (DIN) and the International Organization for Standardization (ISO) to address the reported attacks in the next PDF specification.\u201d\nSee Also: Offensive Security Tool: Snallygaster Stopping Certified PDF AttacksTo fend off Evil Annotation Attacks, the researchers recommend admins prohibit three particularly risky annotations that allow text or images to be added to a certified PDF, \u201cFreeText, Stamp and Redact.\u201d\n\nSneaky Signatures can be blocked by reducing permissions, but that is not a guarantee SSAs won\u2019t g[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:40.405502Z"}]}