8241 matches found
PT-2021-19334
Name of the Vulnerable Software and Affected Versions Foxit Reader version 10.1.1.37576 Description This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw...
CVE-2021-31454: Heap-based Buffer Overflow
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Foxit Reader XFA leadDigits Heap-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the...
Improper Input Validation
Overview sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with...
Content-Security Policy (CSP) Bypas
firefox is vulnerable to content-security policy bypass. Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allows the execution of scripts that should have been blocked...
CVE-2021-31777
The dce aka Dynamic Content Element extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account...
CVE-2021-31777
The TYPO3 Dynamic Content Element (dce) extension vulnerabilities (versions 2.2.0–2.6.x before 2.6.2 and 2.7.x before 2.7.1) allow an SQL Injection via a backend user account. This is confirmed across multiple sources (CVE-2021-31777). A sample exploit exists in public write-ups (e.g., packetstor...
TYPO3 Dynamic Content Element SQL Injection Vulnerability
TYPO3 Dynamic Content Element is a mobile application from the Swiss company TYPO3. TYPO3 Dynamic Content Element has a SQL injection vulnerability, which stems from insufficient filtering of user-supplied data and can be exploited by attackers to inject SQL to obtain data-sensitive information...
SQL Injection in extension "Dynamic Content Element" (dce)
The extension fails to properly sanitize user input and is susceptible to SQL Injection. A TYPO3 backend user account is required to exploit the vulnerability...
SEO Panel 4.8.0 SQL Injection
Exploit Title: blind SQL injection on archive.php of SEO Panel 4.8.0 Author: nu11secur1ty Testing and Debugging: nu11secur1ty Date: 04.25.2021 Vendor: https://www.seopanel.org/ Link: https://www.seopanel.org/spdownload/4.8.0 CVE: CVE-2021-28419 + Exploit Source: !/usr/bin/python3 Author:...
SEO Panel 4.8.0 - (order_col) Blind SQL Injection Exploit (2)
Exploit Title: SEO Panel 4.8.0 - 'ordercol' Blind SQL Injection 2 Author: nu11secur1ty Testing and Debugging: nu11secur1ty Vendor: https://www.seopanel.org/ Link: https://www.seopanel.org/spdownload/4.8.0 CVE: CVE-2021-28419 + Exploit Source: !/usr/bin/python3 Author: @nu11secur1ty CVE-2021-28419...
CVE-2018-25007
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message...
CVE-2018-25007: Improper Check for Unusual or Exceptional Conditions
Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message...
Remote Code Execution (RCE)
flow-server is vulnerable to remote code execution. An attacker is able to exploit the vulnerability by sending a fake synchronization message to the server, updating server-side element property values...
Google Chrome Microsoft Edge Unauthorized Access
The vulnerability of Autofill implementations in Google Chrome and Microsoft Edge browsers is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
PT-2021-8844
Name of the Vulnerable Software and Affected Versions com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin versions 10.0.0 through 10.0.7 Vaadin versions 11.0.0 through 11.0.2 Description A missing check in the UIDL request handler allows an attacker to update element property values via a...
DEBIAN-CVE-2021-31162
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::fromiter function if freeing the element panics...
CVE-2021-31162
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::fromiter function if freeing the element panics...
Siemens network software Uncontrolled Search Code Execution
Siemens’ network software vulnerabilities are related to an uncontrolled element in the search process. Exploiting these vulnerabilities can allow attackers to execute arbitrary code or cause service failures...
