CVE-2021-34170

Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code...

Code injection

Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code...

CVE-2021-34170

Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code...

CVE-2021-34170

Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code...

CVE-2021-34170

CVE-2021-34170 affects Bandai Namco FromSoftware Dark Souls III. The vulnerability allows remote attackers to execute arbitrary code over the network (attack vector: network; no authentication; low complexity; no user interaction). The CVSS v3.1 base score is 9.8 (CRITICAL) with high impact on co...

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

✍️ Description The /export/export endpoint does not have CSRF Protection. This could be used to force download account data and potentially spoof users. 🕵️‍♂️ Proof of Concept - Login to user account. - Create the following file and open the page in browser. // PoC.html To verify that you are a...

Sandbox Escape

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 aka Quake 3 engine forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as...

SQL Injection Vulnerability in ILAS III Digital Library System (CNVD-2020-70576)

ILAS III digital library is a set of library automation integrated system that can adapt to the use of libraries of different levels, scales and types at home and abroad, which is undertaken and organized by the Shenzhen Library. ILAS III digital library system SQL injection vulnerability,...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. An attacker can inject malicious script via auto-completion suggestions for description field for new or edited transactions during adding transaction. This vulnerability is exploitable in a non-default configuration whereby th...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2020-59725)

Firefly III is a free, open source, self-hosted personal finance manager. A cross-site scripting vulnerability exists in the auto-complete feature of the description field in Firefly III versions prior to 5.4.5. An attacker can exploit the vulnerability to execute JavaScript via the suggested...

CVE-2019-19393

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.002 to V3.15.704 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content such as JavaScript or other client-side scripts as the...

U.S. Nuclear Contractor Hit with Maze Ransomware, Data Leaked

A U.S. military contractor involved in the maintenance of the country’s Minuteman III nuclear arsenal has been hit by the Maze ransomware, according to reports – with the hackers making off with reams of sensitive information. The company, Westech International, has a range of contracts with the...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in transaction description field and in asset account name, allowing an attacker to inject malicious script in a convert transaction to get executed upon ...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in the asset account name field, allowing an attacker to inject malicious script through it...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data increate-from-bill name field, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in liability name field, allowing an attacker to inject malicious script in a transaction to get executed upon an error condition during a visit to the...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30450)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.3. The vulnerability stems from a lack of filtering of user-supplied data in the transaction description field. An attacker can exploit this...

Firefly III Cross-Site Scripting Vulnerability

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.5. The vulnerability stems from a lack of filtering of user-supplied data in the liabilityname field. An attacker can exploit the vulnerability to...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30449)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.4. The vulnerability stems from a lack of filtering of user-supplied data in the transaction description field and the asset account name field. An...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30452)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.3. The vulnerability stems from a lack of filtering of user-supplied data in the asset account name field. An attacker can exploit the vulnerability t...