Cross site scripting

An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a tag, bypassing sanitization steps, and potentially allowing for XSS...

CVE-2021-20296

A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR's IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availabili...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2021-22951)

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in Craft CMS version 3.1.31. A remote attacker can inject arbitrary web script or HTML via /admin/settings/sites/n...

Andris Sevcenko craftcms 跨站脚本漏洞

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in Craft CMS version 3.1.31. A remote attacker can inject arbitrary web script or HTML via /admin/settings/sites/n...

CVE-2021-20669

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL...

[ASA-202102-35] python-httplib2: denial of service

Arch Linux Security Advisory ASA-202102-35 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2021-21240 Package : python-httplib2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1546 Summary ======= The package python-httpli...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2021-15498)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. An information disclosure vulnerability exists in Mozilla Firefox. The vulnerability stems from the fact that if a user clicks on a specially crafted PDF, it may obfuscate the leak of cross-domain...

CVE-2020-16589

A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file...

CVE-2021-20244

A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability...

CVE-2021-21122

Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2021-25224

A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cause a denial-of-service on the affected product. The specific flaw exists within a manual scan component. An attacker must first obtain the ability to execu...

CVE-2020-36066

GJSON 1.6.5 allows attackers to cause a denial of service remote via crafted JSON...

Design/Logic Flaw

A flaw was found in ImageMagick in MagickCore/segment.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. This would most likely lead to an impact to application availability, but could potentially cause...

Stack overflow

A stack-based buffer overflow in fbwificontinue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 allows remote unauthenticated attackers to execute arbitrary code via a crafted http packet...

Design/Logic Flaw

A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to specifically craft a malicious packet resulting in a denial-of-service condition on the device...

CVE-2020-5653

Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 Hi...

TextPattern CMS 4.8.3 - Remote Code Execution (Authenticated)

!/usr/bin/python3 Exploit Title: TextPattern = 4.8.3 - Authenticated Remote Code Execution via Unrestricted File Upload Google Dork: N/A Date: 16/10/2020 Exploit Author: Michele '0blio' Cisternino Vendor Homepage: https://textpattern.com/ Software Link: https://github.com/textpattern/textpattern...

CVE-2020-21674

Heap-based buffer overflow in archivestringappendfromwcs archivestring.c in libarchive-3.4.1dev allows remote attackers to cause a denial of service out-of-bounds write in heap memory resulting into a crash via a crafted archive file. NOTE: this only affects users who downloaded the development...

CVE-2020-26164

In kdeconnect-kde aka KDE Connect before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack...

Oracle Linux 7 : expat (ELSA-2020-3952)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3952 advisory. 2.1.0-12 - add security fixes for CVE-2018-20843, CVE-2019-15903 Tenable has extracted the preceding description block directly from the Oracle Linux...