TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17986)

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Typo3 association.TYPO3 suffers from a cross-site scripting vulnerability that stems from the fact that the QueryGenerator and QueryView components are vulnerable to reflected and persistent cross-sit...

Adobe Media Encoder incorrect input validation vulnerability

Adobe Media Encoder, a video and audio encoding application, is vulnerable in Adobe Media Encoder 15.2 and earlier versions. An attacker could exploit the vulnerability to execute arbitrary code...

Adobe Media Encoder out-of-bounds read vulnerability (CNVD-2021-54350)

Adobe Media Encoder, a video and audio encoding application, is vulnerable to an out-of-bounds read vulnerability in Adobe Media Encoder version 15.2 and earlier. An attacker could exploit this vulnerability to execute arbitrary code...

The vulnerability of the HTTP request programming language Python method, related to the lack of mechanisms for encoding or shielding output data, allows attackers to gain access to confidential information and compromise its integrity.

The vulnerability of the HTTP request programming language Python method is related to the lack of mechanisms for encoding or encrypting output data. Exploiting this vulnerability allows an attacker to gain access to confidential data and compromise its integrity...

The vulnerability of the encoding.c component of the GNU Screen window manager allows a hacker to introduce or modify arguments, thereby enabling them to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the encoding.c component of the GNU Screen terminal manager is related to incorrect processing of UTF-8 character sequences. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

UBUNTU-CVE-2021-35043

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer XHTML is not affected. This was demonstrated by a javascript: URL with &00058 as the replacement for the : character...

DNSStager - Hide Your Payload In DNS

DNSStager is an open-source project based on Python used to hide and transfer your payload using DNS. DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as AAAA or TXT records after splitting...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2021-70130)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. The application enables computers and devices to read High Efficiency Video Encoding or HEVC video.A remote code execution vulnerability exists in Microsoft HEVC Video Extensions. An attacker could...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2021-70127)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. The application enables computers and devices to read High Efficiency Video Encoding or HEVC video.A remote code execution vulnerability exists in Microsoft HEVC Video Extensions. An attacker could...

Microsoft HEVC Video Extensions Remote Code Execution Vulnerability (CNVD-2021-70129)

Microsoft HEVC Video Extensions is a video extension application from Microsoft Corporation USA. The application enables computers and devices to read High Efficiency Video Encoding or HEVC video.A remote code execution vulnerability exists in Microsoft HEVC Video Extensions. An attacker could...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-2217)

According to the version of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader for xml.NewTokenDecoder returns EOF in the...

UBUNTU-CVE-2021-27845

A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpcenc.c...

CVE-2021-33683

SAP Web Dispatcher and Internet Communication Manager ICM, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83,...

CVE-2021-33682

SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. This would allow an attacker with basic level privileges to store a malicious script on SAP Lumira Server. The execution of the script content, by a victim...

CVE-2021-33683

SAP Web Dispatcher and Internet Communication Manager ICM, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83,...

CVE-2021-33682

SAP Lumira Server 2.4 is affected by an XSS vulnerability due to insufficient encoding of user-controlled inputs. Attackers with basic (low) privileges can store a malicious script on the server, which would be executed for victims registered on SAP Lumira Server, potentially compromising confide...

PT-2021-20261 · Sap · Sap Web Dispatcher +1

Name of the Vulnerable Software and Affected Versions: SAP Web Dispatcher and Internet Communication Manager ICM versions 7.21 through 7.83 Description: The issue arises from the incorrect handling of invalid HTTP headers, specifically the Transfer-Encoding header, which can lead to an HTTP Reque...

Medium: glibc

Issue Overview: A vulnerability was discovered in glibc where the LDPREFERMAP32BITEXEC environment variable is not ignored when running binaries with the setuid flag on x8664 architectures. This allows an attacker to force system to utilize only half of the memory making the system think the...

CVE-2021-33037

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer...

Integer Overflow in Chunked Transfer-Encoding

Summary hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or...