GHSA-54JJ-PXX2-PV8H TYPO3 doesn't properly check file extensions

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

TYPO3 doesn't properly check file extensions

The 1 file upload component and 2 File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file...

[SECURITY] Fedora 35 Update: gdal-3.3.3-1.fc35

Geospatial Data Abstraction Library GDAL/OGR is a cross platform C++ translator library for raster and vector geospatial data formats. As a library, it presents a single abstract data model to the calling application for all supported formats. It also comes with a variety of useful commandline...

libvcs Command Injection Vulnerability

libvcs is a vcs abstraction layer. libvcs is vulnerable to command injection, which stems from the fact that when the updaterepo function is called, the url argument is passed to the hg clone command, and an attacker can exploit this vulnerability to execute commands by injecting some hg options...

Google Android 安全漏洞

Google Android is a Linux-based open-source operating system from Google, Inc. Google Android is vulnerable to arbitrary memory writes, which can be exploited by attackers to perform arbitrary memory writes and code execution due to incorrect boundary checking in the edenruntime hal service...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

UBUNTU-CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

Doctrine Dbal SQL注入漏洞

Doctrine Dbal is a Doctrine database abstraction layer. A security vulnerability exists in Doctrine DBAL that stems from allowing SQL injection to occur if an application developer ends up using the AbstractPlatform:: modifyLimitQuery API via the proprietary user input DBAL QueryBuilder or any...

kronosnet bug fix update

An update is available for kronosnet. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Kronosnet knet is a network abstraction layer designed for High Availabilit...

CVE-2021-30315

Improper handling of sensor HAL structure in absence of sensor can lead to use after free in Snapdragon Auto...

TIGMINT - OSINT (Open Source Intelligence) GUI Software Framework

An OSINT Open Source Intelligence software framework with an objective of making cyber investigations more convinient by implementing abstraction mechanisms to hide the background technical complexity also bundling different analysis techniques for social media Intelligence together providing a...

[SECURITY] Fedora 34 Update: rust-filetreelist-0.2.0-3.fc34

Filetree abstraction based on a sorted path list, supports key based navigati on events, folding, scrolling and more...

Raider - Web Authentication Testing Framework

This is a framework designed to test authentication for web applications. While web proxies like ZAProxy and Burpsuite allow authenticated tests, they don't provide features to test the authentication process itself, i.e. manipulating the relevant input fields to identify broken authentication...

WordPress Malware Camouflaged As Code

In today’s post we discuss emerging techniques that attackers are using to hide the presence of malware. In the example we discuss below, the attacker’s goal is to make everything look routine to an analyst so that they do not dig deeper and discover the presence of malware and what it is doing. ...

CVE-2021-38623

The deferredimageprocessing aka Deferred image processing extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption...

CVE-2021-38623

The deferredimageprocessing aka Deferred image processing extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API because of /var/transient disk consumption...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 has a denial of service vulnerability that can be exploited by attackers to cause a denial of service via the FAL API...

Fedora: Security Advisory for php-league-flysystem (FEDORA-2021-717516a2e9)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 33 Update: php-league-flysystem-1.1.4-1.fc33

Flysystem is a filesystem abstraction which allows you to easily swap out a local filesystem for a remote one. Autoloader: /usr/share/php/League/Flysystem/autoload.php...

[SECURITY] Fedora 34 Update: php-league-flysystem-1.1.4-1.fc34

Flysystem is a filesystem abstraction which allows you to easily swap out a local filesystem for a remote one. Autoloader: /usr/share/php/League/Flysystem/autoload.php...