CVE-2021-21340

TYPO3 core vulnerability CVE-2021-21340: In TYPO3 versions earlier than 10.4.14 and 11.1.1, database fields used as descriptionColumn could be exploited for cross-site scripting when content is previewed. A valid backend user is required to exploit. The issue is fixed in TYPO3 10.4.14 and 11.1.1....

CVE-2021-21355

TYPO3 8.7.40, 9.5.25, 10.4.14, 11.1.1 fix a file-upload vulnerability where UploadedFileReferenceConverter can accept any mime-type for certain Extbase-based uploads, allowing attackers to place arbitrary files under /fileadmin/user_upload/ (and potentially reference/guess filenames). Impact stat...

CVE-2021-21357

TYPO3 Form Framework vulnerability (CVE-2021-21357): Improper input validation in Form Designer enables bypass of predefined option restrictions, allowing upload of arbitrary MIME types and persistence of files in writable TYPO3 directories. Requires a valid backend user to exploit. Affects TYPO3...

CVE-2021-21358

TYPO3 CMS is affected by a cross-site scripting (XSS) vulnerability in the Form Designer backend module of the Form Framework. The issue exists in TYPO3 versions before 10.4.14 and 11.1.1, and requires a valid backend user account with access to the Form module to exploit. It is fixed in versions...

DynPG 安全漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "page" parameter...

Dynpg组织 Dynpg 跨站脚本漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "query" parameter...

macOS 11.x < 11.2.3 (HT212220)

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.2.3 Big Sur. It is, therefore, affected by a memory corruption issue due to insufficient validation. An attacker can exploit this with crafted web content to cause arbitrary code execution. Note that Nessus has not...

Deserialization vulnerability in kitecms

KiteCMS is an open source web content management system CMS, the system is based on the framework ThinkPHP5.1. version of the development of the system, for individuals and enterprises to quickly build a station and development needs. Kitecms has a deserialization vulnerability that can be...

Apple Issues Patch for Remote Hacking Bug Affecting Billions of its Devices

Apple has released out-of-band patches for iOS, macOS, watchOS, and Safari web browser to address a security flaw that could allow attackers to run arbitrary code on devices via malicious web content. Tracked as CVE-2021-1844, the vulnerability was discovered and reported to the company by Clémen...

Apple Issues Patch for Remote Hacking Bug Affecting Billions of its Devices

Apple has released out-of-band patches for iOS, macOS, watchOS, and Safari web browser to address a security flaw that could allow attackers to run arbitrary code on devices via malicious web content. Tracked as CVE-2021-1844 , the vulnerability was discovered and reported to the company by Cléme...

Command Execution Vulnerability in KiteCMS

KiteCMS open source web content management system CMS, the system is based on the framework ThinkPHP 5.1. version of the development, applicable to individuals and enterprises to quickly build a station and development needs. KiteCMS command execution vulnerability , an attacker can exploit the...

SeaCMS suffers from SQL injection vulnerability (CNVD-2021-17447)

SeaCMS is a web content management system based on PHP MYSQL architecture and can run across platforms. SeaCMS has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in MKCMS Official Version

MKCMS is a free and open source PHP web content management system developed by Yakun Technology. MKCMS official version of the existence of SQL injection vulnerability , attackers can use the vulnerability to obtain sensitive information in the database...

Debian DSA-4854-1 : webkit2gtk - security update

The following vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2020-13558 Marcin Noga discovered that processing maliciously crafted web content may lead to arbitrary code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

[SECURITY] Fedora 33 Update: privoxy-3.0.31-1.fc33

Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit...

Remote Code Execution

webkit2gtk3 is vulnerable to remote code execution. Multiple memory corruption issues were addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution...

Arbitrary Code Execution

webkitgtk is vulnerable to arbitrary code execution. Multiple memory corruption issues allows for arbitrary code execution when processing malicious web content...

Information Disclosure

webkitgtk4 is vulnerable to information disclosure. A validation issue was addressed with improved logic. Processing maliciously crafted web content may result in the disclosure of process memory...

Arbitrary Code Execution

webkitgtk4 is vulnerable to arbitrary code execution. The vulnerability exists through processing maliciously crafted web content...

Apple Safari Resource Management Error Vulnerability

Apple Safari is a web browser from Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems. A security vulnerability exists in Safari 14.0.3 WebKit, which originates from the handling of maliciously crafted web content that could lead to arbitrary code executi...