TYPO3 Information Disclosure Vulnerability (CNVD-2022-17970)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland.TYPO3 has an information disclosure vulnerability that originates from the extension's inability to protect or obfuscate the filename of uploaded files, which can be exploited by ...

FATEK Automation WinProladder 安全漏洞

FATEK Automation WinProladder is a PLC from FATEK Automation in China.FATEK Automation WinProladder is vulnerable to an unexpected flag extension vulnerability, which can be exploited by attackers to execute arbitrary code...

CVE-2021-33362

Stack buffer overflow in the hevcparsevpsextension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file...

Cross site scripting

The miniorangesaml aka Miniorange Saml extension before 1.4.3 for TYPO3 allows XSS...

WordPress SP Project And Document Remote Code Execution Exploit

This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in WordPress SP Project and Document plugin versions prior to 4.22. The security check only searches for lowercase file extensions such as .php,...

The vulnerability of Google Chrome browser extensions, related to improper authorization, allows a perpetrator to compromise data integrity.

The vulnerability of Google Chrome browsers is related to the insufficient implementation of policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity remotely...

Microsoft Windows Codecs Library 代码注入漏洞

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA. Image Extension is an image extension application developed by Microsoft that allows you to view images in Raw format.A remote code execution vulnerability exists in Raw Image Extension in Microsoft...

The vulnerability of the PHP SOAP extension allows a attacker to trigger an emergency shutdown of the application.

The vulnerability of the PHP SOAP extension interpreter is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker, operating remotely, to cause the application to terminate abnormally...

Google Chrome 资源管理错误漏洞

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A post-release reuse vulnerability exists in "Extensions" in Google Chrome versions prior to 91.0.4472.101. No details of the vulnerability are available at this ti...

Unrestricted file upload

Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc"...

Server-side request forgery in extension "Yoast SEO for TYPO3" (yoast_seo)

The extension fails to restrict analyzed URLs to domains managed by the current TYPO3 website. A logged in TYPO3 backend user can use the vulnerability to make HTTP requests to arbitrary domains including the webserver itself or other internally managed resources...

Remote code execution

Raw Image Extension Remote Code Execution Vulnerability...

PT-2021-2726 · Microsoft · Visual Studio Code Kubernetes Tools Extension

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio Code Kubernetes Tools Extension affected versions not specified Description: The issue is related to incorrect code generation management in the Microsoft Visual Studio Code Kubernetes Tools Extension. Exploitation of...

Unspecified vulnerability in Firefox unity-firefox-extension

Firefox unity-firefox-extension is a Firefox open source application plug-in . A security vulnerability exists in Firefox unity-firefox-extension that originates from sending an empty unity-firefox-extension package, which completely disables the extension and invalidates attacks against the libu...

CVE-2021-28953

The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted repository...

ONLYOFFICE Document Server File Extension Handling Vulnerability

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. ONLYOFFICE Document Server suffers from a file extension handling vulnerability that can be exploited by an attacker requesting data to control file...

ONLYOFFICE Document Server File Extension Handling Vulnerability (CNVD-2021-17248)

ONLYOFFICE Document Server is a free collaborative online office suite that includes viewers and editors for text, spreadsheets and presentations. A file extension handling vulnerability exists in the ONLYOFFICE DocumentServer core module, which can be exploited by an attacker to remotely execute...

The vulnerability of the “Startup Configuration” page of the asynchronous replication extension for VMware vSphere Replication allows a attacker to execute arbitrary code.

The vulnerability of the “Startup Configuration” page of the VMware vSphere Replication asynchronous replication extension is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2021-21144

Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension...

CVE-2020-35112

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension such as .bat or .exe that executable would have been launched instead. Note:...