Design/Logic Flaw

Craft CMS before 3.7.14 allows CSV injection...

CVE-2021-41824

Craft CMS before version 3.7.14 is vulnerable to CSV injection via export functionality. The root cause is lack of input sanitization/escaping when exporting data to CSV, allowing crafted input to trigger payloads in CSV readers (e.g., Excel). Affected software is Craft CMS (core) with CSV export...

CVE-2021-41824

Craft CMS before 3.7.14 allows CSV injection...

Pixel＆tonic Craft CMS 代码注入漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic USA. A security vulnerability exists in Pixel & Tonic Craft CMS versions prior to 3.7.14 that could lead to CSV injection...

AZL-6487 CVE-2021-40438 affecting package httpd for versions less than 2.4.52-1

A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier...

DEBIAN-CVE-2021-30590

Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Google Chrome Type Obfuscation Vulnerability (CNVD-2021-68457)

Chrome, a web browsing tool developed by Google, is vulnerable to a type obfuscation vulnerability in V8 in versions prior to Google Chrome 92.0.4515.159. An attacker could exploit this vulnerability to execute arbitrary code inside a sandbox via a crafted HTML page...

CVE-2021-37688

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service. The implementation unconditionally dereferences a pointer. We have...

CVE-2021-37619

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An...

CVE-2021-32752

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may...

Design/Logic Flaw

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may...

CVE-2021-32752 Files or Directories Accessible to External Parties in ether/logs

Ether Logs is a package that allows one to check one's logs in the Craft 3 utilities section. A vulnerability was found in versions prior to 3.0.4 that allowed authenticated admin users to access any file on the server. The vulnerability has been fixed in version 3.0.4. As a workaround, one may...

CVE-2021-32752

Ether Logs (Craft 3) prior to version 3.0.4 is affected. An authenticated admin can access any file on the server due to a vulnerability in the plugin’s handling of file access. The issue has been fixed in version 3.0.4. As a workaround, disable the plugin if admin access by untrusted sources is ...

CVE-2021-32972

Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing softwa...

Craft CMS Remote Code Injection

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes if an attacker were somehow able to hijack an administrator's session...

GHSA-X2J7-6HXM-87P3 Craft CMS Remote Code Injection

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes if an attacker were somehow able to hijack an administrator's session...

Craft CMS Cross-site Scripting Vulnerability

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

GHSA-3JXH-789F-P7M6 Craft CMS Cross-site Scripting Vulnerability

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads...

Craft CMS Cross-Site Scripting Vulnerability (CNVD-2021-46873)

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A cross-site scripting vulnerability exists in a front-end form that accepts user uploads in versions of Craft CMS prior to 3.6.0. Detailed vulnerability...

Craft CMS Remote Code Execution Vulnerability

Craft CMS is a content management system for developers, designers and web professionals that provides flexibility, power and ease of use. A remote code execution vulnerability exists in Craft CMS versions prior to 3.6.7 without restricting administrator changes. An attacker can exploit this...