CVE-2025-0443: Improper Neutralization of Input During Web Page Generation

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0446: User Interface (UI) Misrepresentation of Critical Information

Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

Drupal Allow All File Extensions Code Execution

The vulnerability of the “Allow All File Extensions” module for file fields in Drupal CMS systems is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery

Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP...

CVE-2024-57487

In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute commands on the server...

PT-2025-5628 · Intel · Intel Sgx

Name of the Vulnerable Software and Affected Versions: Intel SGX affected versions not specified Description: The issue is a side-channel timing attack against Intel SGX enclaves, which can lead to the complete compromise of Trusted Execution Environment TEE attestation. A proof of concept PoC ha...

CVE-2024-42180

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files...

CVE-2024-42180

CVE-2024-42180 affects HCL DRYiCE MyXalytics (HCL MyXalytics). The vulnerability is a malicious file upload issue where the application accepts invalid uploads (wrong content types, double extensions, null bytes, and special characters), enabling an attacker to upload and potentially execute mali...

CVE-2024-42180: Unrestricted Upload of File with Dangerous Type

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files...

Gramine security vulnerabilities

Gramine is an open source Linux multiprocess application library operating system supporting Intel SGX by The Gramine Project. A security vulnerability exists in Gramine, which stems from a mismatch between SW signals and HW anomalies, resulting in an interface vulnerability...

CVE-2024-13311

The Allow All File Extensions module for file fields in Drupal CMS systems is vulnerable to remote code execution due to insufficient validation of input data . This flaw specifically affects the module when configured with the 👀.👀 wildcard. Exploitation of this vulnerability allows a malicious a...

Google Chrome AI extensions deliver info-stealing malware in broad attack

Small businesses and boutique organizations should use caution when leaning on browser-friendly artificial intelligence AI tools to generate ideas, content, and marketing copy, as a set of Google Chrome extensions were recently compromised to deliver info-stealing malware disguised as legitimate...

Drupal security vulnerabilities

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Allow All File Extensions for file fields, which stems from the presence of an issue...

CVE-2024-13311: Undefined Security Weakness

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields:...

qt6-webengine -- Multiple vulnerabilities

Qt qtwebengine-chromium repo reports: Backports for 9 security bugs in Chromium: CVE-2024-12693: Out of bounds memory access in V8 CVE-2024-12694: Use after free in Compositing CVE-2025-0436: Integer overflow in Skia CVE-2025-0437: Out of bounds read in Metrics CVE-2025-0438: Stack buffer overflo...

cosmopower (0.2.0), guardrail-ml (>=0.0.14, <=0.0.15) +7 more potentially affected by CVE-2024-55459 via keras (2.15.0rc1)

keras PYPI version 2.15.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cosmopower 0.2.0 - guardrail-ml =0.0.14, =0.5.10, =0.1.0, =2.14.0rc0, =2.14.0rc0, =2.14.0rc1 - tensorflow-text 2.13.0rc0 - tf-extensions 0.1.0...

CVE-2023-6601 Ffmpeg: hls unsafe file extension bypass in ffmpeg

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions...

CVE-2023-6601

CVE-2023-6601 is a vulnerability in FFmpeg’s HLS demuxer that enables bypassing unsafe file extension checks and triggering arbitrary demuxers via base64 data URIs with specific extensions. Public details in the provided connected advisories attribute the issue to FFmpeg and acknowledge fixes in ...

CVE-2023-6601 Ffmpeg: hls unsafe file extension bypass in ffmpeg

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions...

bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

A flaw was found in bind9. By flooding a DNSSEC resolver with responses coming from a DNSEC-signed zone using NSEC3, an attacker can lead the targeted resolver to a CPU exhaustion, further leading to a Denial of Service on the targeted host. This vulnerability applies only for systems where DNSSE...