Mozilla: Prototype pollution in Top-Level Await implementation

The Mozilla Foundation Security Advisory describes this flaw as: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context...

Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution

The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the...

Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution

The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the...

Mozilla: Prototype pollution in Top-Level Await implementation

The Mozilla Foundation Security Advisory describes this flaw as: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context...

Alfresco 跨站脚本漏洞

Alfresco is an open source enterprise content management system. The platform page using Freemarker development , the main features include document management , collaboration , records management , knowledge base management , Web content management and so on. Alfresco has a security vulnerabilit...

CVE-2021-1871

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this...

B2evolution Cms Cross-Site Scripting Vulnerability

b2evolution is a community content management system based on PHP and MySQL. A cross-site scripting vulnerability exists in B2evolution Cms, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side...

CVE-2020-27192

BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2020-63724)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Unspecified vulnerability in Kaoni ezHTTPTrans (CNVD-2021-37778)

Kaoni ezHTTPTrans is a forwarding proxy software. A security vulnerability exists in Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and earlier versions. A remote attacker can exploit this vulnerability to download arbitrary files and execute code...

Command Execution Vulnerability in PbootCMS V1.3.2

PbootCMS is an open source enterprise building content management system CMS developed using the PHP language. PbootCMS V1.3.2 suffers from a command execution vulnerability that can be exploited by an attacker to execute code...

HashBrown CMS Remote Code Execution Vulnerability

HashBrown CMS is an open source headless content management system CMS. HashBrown CMS suffers from a remote code execution vulnerability that stems from the program not performing proper security checks. An attacker could exploit the vulnerability to execute code...

PrestaShop cross-site scripting vulnerability (CNVD-2020-02542)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop version 1.7.6.2. The...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-36981)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite versions 7.10.1 and 7.10.2. The vulnerabili...

CVE-2019-2390

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; Mongo...

DEBIAN-CVE-2017-7526

libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This...

Palo Alto Networks Panorama VM Appliance Arbitrary Code Execution Vulnerability

Palo Alto Networks Panorama VM Appliance is a solution from Palo Alto Networks, Inc. that supports the use of Panorama as a virtual appliance to manage distributed firewall networks through a central location. An arbitrary code execution vulnerability exists in the Palo Alto Networks Panorama VM...

Dotproject HTML Injection Vulnerability

Dotproject is a set of Web-based project management and tracking tools. The tool provides modules for company management, project management and task progress tracking. An HTML injection vulnerability exists in Dotproject, which stems from the program's failure to adequately filter user-submitted...

MiniWeb (Build 300) Arbitrary File Upload

This module exploits a vulnerability in MiniWeb HTTP server build 300. The software contains a file upload vulnerability that allows an unauthenticated remote attacker to write arbitrary files to the file system. Code execution can be achieved by first uploading the payload to the remote machine ...

cURL and libcurl MD5 Digest Buffer Overflow (CVE-2013-0249)

The vulnerability is due to an error in Curlsaslcreatedigestmd5message while negotiating SASL DIGEST-MD5 authentication. A remote attacker can exploit this vulnerability by enticing a user to connect to a malicious server. This can lead to code execution in the context of the affected application...