TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C 8.2 Problem TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In combination with the TypoScript setting...

CVE-2023-23849

Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub domain can set a cookie for the whole subdomain which can be used to bypass other mitigations in place for malicious purposes...

Command injection

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules...

CVE-2023-24276: Improper Neutralization of Special Elements used in a Command

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules...

PT-2023-1591

Name of the Vulnerable Software and Affected Versions TOTOLINK A7100RU version V7.4cu.2313 B20191024 Description The issue is related to a lack of input data sanitization in the settings/delStaticDhcpRules file of the TOTOLINK A7100RU router's firmware, allowing a remote attacker to execute...

CVE-2023-23925 Switcher Client contains Regular Expression Denial of Service (ReDoS)

Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation EXIST, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack reDOS. This issue has been...

VK All in One Expansion Unit < 9.86.0.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Setup: The CTA Expansion...

Design/Logic Flaw

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users...

Selfwealth 安全漏洞

Selfwealth is a stock investment trading platform from Selfwealth Australia. A security vulnerability exists in Selfwealth iOS mobile App version 3.3.1, which originates from an insecure setting transmitted by the application...

CVE-2022-32526: Buffer Copy without Checking Size of Input

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted setting value messages. Affected Products: IGSS Data Server - IGSSdataServer.exe Version...

CVE-2022-3430

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

CVE-2022-48125

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function...

CVE-2022-48121

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function...

CVE-2022-48122

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function...

CVE-2022-48122

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function...

CVE-2022-48123

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function...

Command injection

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function...

Command injection

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function...

Command injection

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function...

Command injection

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function...