Ec-cube 跨站请求伪造漏洞

Ec-cube is an open source e-commerce system from the Japanese company Ec-cube. The EC-CUBE plugin suffers from a cross-site request forgery vulnerability that exists due to insufficient authentication of the HTTP request source. A remote attacker could use this vulnerability to trick a victim int...

The vulnerability of PDF files created by AcroForms, a text viewing program called Foxit Reader, and the PDF editing program Foxit PhantomPDF, allowing attackers to disclose protected information.

The vulnerability of PDF files created by AcroForms, as well as the Foxit Reader and Foxit PhantomPDF programs used for PDF editing, is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to resource management errors, which can be exploited by attackers to perform sandbox escapes through carefully crafted HTML pages...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to resource management errors, which can be exploited by attackers to exploit heap corruption via carefully crafted HTML pages...

Google Chrome 安全特征问题漏洞

Google Chrome is a web browser from Google, Inc. Google Chrome is vulnerable to a security feature that could be exploited by attackers to bypass site quarantine via crafted HTML pages...

The vulnerability of the TabStrip control element in Google Chrome web browsers involves an operation that goes beyond the acceptable buffer data limit. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the TabStrip control element in Google Chrome browsers relates to the execution of operations that exceed the allowed buffer data limits. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and cause service...

Google Chrome 安全特征问题漏洞

Chrome is a web browsing tool developed by Google. iFrame Sandbox is improperly implemented in versions prior to Google Chrome 95.0.4638.54. An attacker could exploit this vulnerability to bypass navigation restrictions via crafted HTML pages...

The vulnerability of the Siemens Solid Edge Viewer application, a tool set for design and simulation with Siemens Solid Edge, allows a malicious actor to execute arbitrary code.

The vulnerability of the Siemens Solid Edge Viewer application, a tool for design and simulation, is related to the use of memory after it is freed during OBJ file syntax analysis. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created malicio...

Apple tvOS 缓冲区错误漏洞

Apple tvOS is a set of smart TV operating systems from Apple USA. A buffer error vulnerability exists in Apple TV 4K and Apple TV HD, which stems from a boundary error when processing font files in FontParser. The vulnerability can be exploited to trick a victim into opening a specially crafted...

CVE-2021-30602

Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to potentially exploit heap corruption via a crafted HTML page...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome WebSerial, which allows remote attackers to potentially attack via specially crafted HTML pages using heap corruption...

Innorix Web-Based File Transfer 参数注入漏洞

INNORIX Innorix Web-Based File Transfer is an application system from INNORIX Korea. It is used for file transfer. Web-Based File Transfer Solution 9.2.18.385 suffers from a parameter injection vulnerability that can be exploited by a remote attacker to potentially trick a user into visiting a...

NBBDownloader.ocx ActiveX 参数注入漏洞

SearchDomino.com ActiveX is an application from SearchDomino.com, Inc. Real-Time, Collaborative Enabled Programs NBBDownloader.ocx ActiveX suffers from a parameter injection vulnerability that can be exploited by remote attackers to trick users into visiting a crafted web page, which can cause...

Google Chrome 缓冲区错误漏洞

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. Versions of Google Chrome before 89.0.4389.72 are stored secure. Remote attackers can cause heap of damage through carefully crafted HTML pages...

CVE-2020-8902

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery SSRF attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are t...

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Vulnerabilities of operating systems such as iOS, iPadOS, tvOS, watchOS, Safari browser, and the multimedia player iTunes for Windows operating systems, as well as the iCloud service for Windows operating systems, are related to data type conversion errors, allowing attackers to execute arbitrary code.

Vulnerabilities of operating systems such as iOS, iPadOS, tvOS, watchOS, Safari browser, and the multimedia player iTunes for Windows operating systems, as well as the iCloud service for Windows operating systems, are related to data type conversion errors. Exploiting these vulnerabilities can...

chromium-browser: Incorrect security UI in permissions

Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page...

CVE-2020-1379

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights. There are multiple ways an...

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server arises from insufficient validation of input data, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server is related to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created page...