PT-2025-16139 · Mediawiki · Mediawiki - Tabs Extension

Name of the Vulnerable Software and Affected Versions: Mediawiki - Tabs Extension versions 1.39 through 1.43 Description: The issue is related to an Improper Input Validation vulnerability that allows Code Injection in the Mediawiki - Tabs Extension. Recommendations: For versions 1.39 through 1.4...

The vulnerability of the Clickstorm SEO (cs_seo) extension of the TYPO3 content management system, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Clickstorm SEO csseo extension of the TYPO3 content management system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

PT-2025-25662

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

Linux Distros Unpatched Vulnerability : CVE-2017-16642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelibmeridian handling of 'front of' and 'back of' directiv...

CVE-2022-47408

An issue was discovered in the fpnewsletter aka Newsletter subscriber management extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people...

CVE-2020-13544

An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker application. A specially crafted document can cause the document parser to sign-extend a length used to terminate a loop, which can later result in the loop’s...

Remote File Orchestrator Extension 安全漏洞

Remote File Orchestrator Extension is an open source remote file orchestrator extension for Keyfactor. It is used to remotely manage various file-based certificate stores and can be easily extended to manage other certificate stores. A security vulnerability exists in Remote File Orchestrator...

smartUp 跨站脚本漏洞

smartUp is a customizable web browser mouse gesture extension from zimocode open source. A cross-site scripting vulnerability exists in smartUp version 7.2.622.1170, which stems from the presence of a cross-site scripting vulnerability that allows another extension to execute arbitrary code in th...

Google Chrome 安全漏洞

Google Chrome is a free web browser developed by Google. It is the world's largest browser in terms of market share due to its speed, security, simplicity, multi-platform support and built-in privacy protection. Google Chrome suffers from a Data Validation Insufficiency vulnerability, which can b...

CVE-2024-39668

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in petesheppard84 Extensions for Elementor allows Stored XSS.This issue affects Extensions for Elementor: from n/a through 2.0.31...

CVE-2024-4868

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-5461 · Google +6 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.182 Microsoft Edge affected versions not specified Description: The issue is related to a use after free in the Navigation function, which could allow an attacker to exploit heap corruption via a...

PT-2024-26128 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Hoppscotch Browser Extension versions prior to 0.35 Description: The issue arises from an oversight in the Hoppscotch Browser Extension, allowing messages to be sent and processed from unauthorized origins. This exposes users to potential...

SUSE CVE-2024-3844

Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

PT-2024-3078 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 124.0.6367.60 Description: The issue is related to an inappropriate implementation in the Extensions component of Google Chrome, which may allow a remote attacker to perform UI spoofing via a crafted Chrome...

CVE-2024-29898

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the read permission...

CVE-2024-29805

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ShopUp Shipping with Venipak for WooCommerce allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through 1.19.5...

CVE-2023-45889

A Universal Cross Site Scripting UXSS vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScript into any webpage. NOTE: this issue exists because of an incomplete fix for CVE-2022-48612...

CVE-2023-50708 yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison...

postgresql: extension script @substitutions@ within quoting allow SQL injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...