CVE-2024-37732

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...

PT-2024-13851 · Prestashop · Prestashop M4 Pdf Extensions Module

Name of the Vulnerable Software and Affected Versions: PrestaShop M4 PDF Extensions module versions up to 3.3.2 Description: The issue allows attackers to run arbitrary code via the M4PDF::saveTemplate method, potentially leading to code injection attacks. This could enable malicious activities,...

Anchor Cross-Site Scripting Vulnerability

Anchor is an open source lightweight blogging system. A cross-site scripting vulnerability exists in Anchor version v.0.12.7, which originates from a vulnerability that could allow a remote attacker to execute arbitrary code via a crafted .pdf file...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

CVE-2023-50029

CVE-2023-50029 affects PrestaShop’s M4 PDF Extensions (m4pdf) module up to version 3.3.2 by PrestaAddons. The vulnerability allows PHP injection through M4PDF::saveTemplate(), enabling arbitrary code execution. Documented impact is critical (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No expl...

CVE-2023-50029

PHP Injection vulnerability in the module "M4 PDF Extensions" m4pdf up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate method...

CVE-2024-37732

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...

CVE-2024-37732

CVE-2024-37732 affects Anchor CMS v0.12.7. The vulnerability is described as a Cross-Site Scripting issue that allows a remote attacker to execute arbitrary code via a crafted .pdf file. All provided sources (NVD, Red Hat, OSV, CVE list, CNNVD, etc.) consistently cite the same description, confir...

CVE-2024-37732

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file...

CVE-2023-45673

Joplin is a free, open source note taking and to-do application. A remote code execution RCE vulnerability in affected versions allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands. Clicking links in PDFs allows for arbitrary code execution because Joplin...

CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin

Joplin is a free, open source note taking and to-do application. A remote code execution RCE vulnerability in affected versions allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands. Clicking links in PDFs allows for arbitrary code execution because Joplin...

CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin

Joplin is a free, open source note taking and to-do application. A remote code execution RCE vulnerability in affected versions allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands. Clicking links in PDFs allows for arbitrary code execution because Joplin...

CVE-2023-45673

CVE-2023-45673 affects Joplin desktop prior to version 2.13.3. A remote code execution vulnerability arises when a user clicks a link in a PDF embedded in an untrusted note, because the app does not disable top redirection for note viewer iframes and node integration is enabled. Impact is executi...

Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia

Cisco Talos discovered a new remote access trojan RAT dubbed SpiceRAT, used by the threat actor SneakyChef in a recent campaign targeting government agencies in EMEA and Asia. We observed that SneakyChef launched a phishing campaign, sending emails delivering SugarGh0st and SpiceRAT with the same...

Oyster Backdoor Spreading via Trojanized Popular Software Downloads

A malvertising campaign is leveraging trojanized installers for popular software such as Google Chrome and Microsoft Teams to drop a backdoor called Oyster aka Broomstick and CleanUpLoader. That's according to findings from Rapid7, which identified lookalike websites hosting the malicious payload...

The vulnerability of the Audio component in Microsoft Edge and Google Chrome browsers allows attackers to disclose protected information.

The vulnerability of the Audio component in Microsoft Edge and Google Chrome lies in the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to expose sensitive information through specially created PDF files...

The vulnerability of the PDFium PDF-content processor in Microsoft Edge and Google Chrome browsers allows a hacker to disclose protected information.

The vulnerability of the PDFium PDF-content processor in Microsoft Edge and Google Chrome browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to disclose protected information through specially created PDF files...

PT-2024-5242 · Roundup · Roundup

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0 Description: The issue is related to the lack of protection of the web page structure in the Roundup error tracking system. This allows a remote attacker to conduct cross-site scripting attacks by uploading...

Important: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...