ONLYOFFICE Document Server File Extension Handling Vulnerability

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. ONLYOFFICE Document Server suffers from a file extension handling vulnerability that can be exploited by an attacker requesting data to control file...

The vulnerability of the “Startup Configuration” page of the asynchronous replication extension for VMware vSphere Replication allows a attacker to execute arbitrary code.

The vulnerability of the “Startup Configuration” page of the VMware vSphere Replication asynchronous replication extension is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2021-21144

Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension...

CVE-2020-35112

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension such as .bat or .exe that executable would have been launched instead. Note:...

CVE-2020-13544

An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document can cause the document parser to sign-extend a length used to terminate a loop, which can later result in the loop’s...

Heap Corruption

Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

CVE-2020-12912

A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit RAPL interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access...

Raw Image Extension Remote Code Execution Vulnerability (CNVD-2021-24028)

Raw Image Extension is an image extension application developed by Microsoft that allows you to view images in Raw format. A remote code execution vulnerability exists in versions prior to Raw Image Extension 1.0.32861.0. An attacker can exploit this vulnerability to achieve remote code execution...

CVE-2020-6440

Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information via a crafted Chrome Extension...

Google Chrome Extension Policy Enforcement Deficiency Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. An extension policy enforcement deficiency vulnerability exists in versions of Google Chrome prior to 80.0.3987.149. An attacker can exploit this vulnerability to...

libyang lys_extension_instances_free() memory misreference vulnerability

libyang is a data modeling language library. A memory misreference vulnerability exists in libyang lysextensioninstancesfree, which can be exploited by an attacker to submit a special file request and trick the user into parsing it, which can be used in a denial of service attack...

CVE-2019-13755

Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page...

Design/Logic Flaw

Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions...

Unspecified vulnerability in McAfee Data Loss Prevention Endpoint ePO extension

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from McAfee, Inc. that prevents theft and accidental disclosure of confidential data and provides security policies for file processing and transmission, shared data flow control and data encryption. The...

MediaWiki MobileFrontend extension cross-site scripting vulnerability

MediaWiki is the American MediaWiki Wikimedia Foundation's set of free and free web-based Wiki engine. The product can be used to deploy in-house knowledge management and content management systems. mobileFrontend extension is used in one of the mobile front-end extension. A cross-site scripting...

UBUNTU-CVE-2019-5768

DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension...

Typo3 CMS Static Info Tables 6.7.3 Database Disclosure

Exploit Title : Typo3 CMS Static Info Tables Extension 6.7.3 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org - extensions.typo3.org/extension/staticinfotables/ Software Download Link :...

CVE-2018-16295

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Reader before 9.3 and PhantomPDF before 9.3, a different vulnerability than CVE-2018-16291, CVE-2018-16292, CVE-2018-16293, CVE-2018-16294, CVE-2018-16296, and CVE-2018-16297. A specially crafted PDF document can...

Google Chrome elevation of privilege vulnerability (CNVD-2018-11354)

Google Chrome is a web browser developed by Google, Inc.Extensions is one of the browser extensions. A security vulnerability exists in Extensions in versions of Google Chrome prior to 66.0.3359.170. A remote attacker can exploit the vulnerability by tricking a user into visiting a specially...

TYPO3 Direct Mail Extended Authentication Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. direct Mail is one of the extensions to send mail without the need for SMTP servers . An authentication bypass vulnerability exists in the TYPO3 Direct Mail extension. An attacke...