322 matches found
Mozilla: XLL file extensions were downloadable without warnings
The Mozilla Foundation Security Advisory describes this flaw as: Excel .xll add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm...
ALPINE-CVE-2023-39417
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...
AZL-27892 CVE-2023-39417 affecting package postgresql for versions less than 14.10-1
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct dollar quoting, '', or "". If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with...
SUSE CVE-2023-4078
Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...
The vulnerability of the Cgo extension in the Go programming language allows a hacker to execute arbitrary code.
The vulnerability of the Cgo programming language extension is related to the introduction or modification of arguments to the compiler’s flags in the CgoLDFLAGS directive. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
DEBIAN-CVE-2023-3138
A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust...
Researchers Uncover Publisher Spoofing Bug in Microsoft Visual Studio Installer
Security researchers have warned about an "easily exploitable" flaw in the Microsoft Visual Studio installer that could be abused by a malicious actor to impersonate a legitimate publisher and distribute malicious extensions. "A threat actor could impersonate a popular publisher and issue a...
PT-2023-23955 · Craft Cms · Craft Cms
Name of the Vulnerable Software and Affected Versions: Craft CMS versions prior to 4.4.6 Description: The issue is related to an unrestricted file extension that may lead to Remote Code Execution. In the View.php's doesTemplateExist - resolveTemplate - resolveTemplateInternal - resolveTemplate...
PT-2023-2712 · Unknown · Av1 Video Extension
Name of the Vulnerable Software and Affected Versions: AV1 Video Extension affected versions not specified Description: The issue is related to insufficient input validation in the AV1 Video Extension codec. Exploitation of this issue may allow an attacker to execute arbitrary code using a...
The vulnerability of Google Chrome browser extensions allows a hacker to bypass security restrictions and gain unauthorized access to protected information.
The vulnerability of Google Chrome browser extensions is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information through a specially created malicious web page...
Authentication Bypass
Google Chrome is vulnerable to Authentication Bypass. The vulnerability exists due to the inappropriate implementation in Extensions, which convince a user to install a malicious extension to bypass file access restrictions via a crafted HTML page...
UBUNTU-CVE-2023-1813
Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...
PT-2023-7625 · Asus · Asus Asmb8 Ikvm
Name of the Vulnerable Software and Affected Versions: ASUS ASMB8 iKVM firmware versions 1.14.51 and earlier Description: The issue allows remote attackers to execute arbitrary code by using SNMP to create extensions. This can be demonstrated by using snmpset for NET-SNMP-EXTEND-MIB with /bin/sh...
SUSE CVE-2006-3018
Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack vectors related to heap corruption...
SUSE CVE-2010-4819
The ProcRenderAddGlyphs function in the Render extension render/render.c in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service server crash via unspecified vectors related to an "input sanitization flaw."...
SUSE CVE-2014-3172
The Debugger extension API in browser/extensions/api/debugger/debuggerapi.cc in Google Chrome before 37.0.2062.94 does not validate a tab's URL before an attach operation, which allows remote attackers to bypass intended access limitations via an extension that uses a restricted URL, as...
SUSE CVE-2021-4055
Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension...
SUSE CVE-2021-21202
Use after free in extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension...
The vulnerability of the Windows Internet Key Exchange (IKE) extension on Windows operating systems allows a hacker to induce a service failure.
The vulnerability of the Windows Internet Key Exchange IKE extension in Windows operating systems is related to insufficient input data validation. Exploiting this vulnerability can allow a malicious actor to cause service failures using specially created packages...
