Foxit Reader XFA leadDigits Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the...

Improper Input Validation

Overview sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with...

Content-Security Policy (CSP) Bypas

firefox is vulnerable to content-security policy bypass. Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allows the execution of scripts that should have been blocked...

CVE-2021-31777

The dce aka Dynamic Content Element extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account...

CVE-2021-31777

The TYPO3 Dynamic Content Element (dce) extension vulnerabilities (versions 2.2.0–2.6.x before 2.6.2 and 2.7.x before 2.7.1) allow an SQL Injection via a backend user account. This is confirmed across multiple sources (CVE-2021-31777). A sample exploit exists in public write-ups (e.g., packetstor...

TYPO3 Dynamic Content Element SQL注入漏洞

TYPO3 Dynamic Content Element is a mobile application from the Swiss company TYPO3. TYPO3 Dynamic Content Element has a SQL injection vulnerability, which stems from insufficient filtering of user-supplied data and can be exploited by attackers to inject SQL to obtain data-sensitive information...

SQL Injection in extension "Dynamic Content Element" (dce)

The extension fails to properly sanitize user input and is susceptible to SQL Injection. A TYPO3 backend user account is required to exploit the vulnerability...

SEO Panel 4.8.0 - (order_col) Blind SQL Injection Exploit (2)

Exploit Title: SEO Panel 4.8.0 - 'ordercol' Blind SQL Injection 2 Author: nu11secur1ty Testing and Debugging: nu11secur1ty Vendor: https://www.seopanel.org/ Link: https://www.seopanel.org/spdownload/4.8.0 CVE: CVE-2021-28419 + Exploit Source: !/usr/bin/python3 Author: @nu11secur1ty CVE-2021-28419...

SEO Panel 4.8.0 SQL Injection

Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0 Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 04.25.2021 Vendor: https://www.seopanel.org/ Link: https://www.seopanel.org/spdownload/4.8.0 CVE: CVE-2021-28419 + Exploit Source: !/usr/bin/python3 Author:...

Remote Code Execution (RCE)

flow-server is vulnerable to remote code execution. An attacker is able to exploit the vulnerability by sending a fake synchronization message to the server, updating server-side element property values...

The vulnerability of the Autofill function implementations in Google Chrome and Microsoft Edge browsers allows attackers to gain unauthorized access to protected information.

The vulnerability of Autofill implementations in Google Chrome and Microsoft Edge browsers is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

DEBIAN-CVE-2021-31162

In the standard library in Rust before 1.52.0, a double free can occur in the Vec::fromiter function if freeing the element panics...

Siemens network software vulnerabilities, related to an uncontrolled search element, allow attackers to execute arbitrary code or cause service failures.

Siemens’ network software vulnerabilities are related to an uncontrolled element in the search process. Exploiting these vulnerabilities can allow attackers to execute arbitrary code or cause service failures...

CVE-2021-31162

In the standard library in Rust before 1.52.0, a double free can occur in the Vec::fromiter function if freeing the element panics...

CVE-2021-31162

In the standard library in Rust before 1.52.0, a double free can occur in the Vec::fromiter function if freeing the element panics...

Cross-site Scripting in vis-timeline

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...

Adobe RoboHelp 代码问题漏洞

Adobe RoboHelp is a software application from Adobe USA. Next-generation software for authoring and publishing help, strategy, and knowledge base content. Adobe RoboHelp is vulnerable to an uncontrolled search path element vulnerability. An attacker can exploit this vulnerability to elevate...

Siemens LOGO! Soft Comfort

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

Design/Logic Flaw

DISPUTED A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is...