CVE-2021-23999

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

CVE-2021-23999

CVE-2021-23999 describes a sandbox/privilege issue where a Blob URL loaded via an unusual user interaction could be executed with System Principal privileges, affecting Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox

CVE-2021-23999

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

PHPCMS 代码注入漏洞

PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules such as news, pictures, downloads, information and products. A command injection vulnerability exists in phpCMS 2008 sp4. An attacker can exploit this vulnerability to execute arbitrary php...

bloofoxCMS 代码问题漏洞

bloofoxCMS is a free open source PHP + MySQL based Web content management system . An unrestricted file upload vulnerability exists in bloofoxCMS version 0.5.2.1. An attacker can exploit this vulnerability to upload malicious files...

The vulnerability of the Web page rendering module in WebKit operating systems on Mac OS allows a hacker to execute arbitrary code.

The vulnerability of the Web page rendering module in WebKit operating systems on Mac OS is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using malicious web content, from a remot...

The vulnerability of the Web page rendering module in WebKit operating systems on Mac OS allows a hacker to execute arbitrary code.

The vulnerability of the Web page rendering module in WebKit operating systems on Mac OS is related to the improper implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using malicious web content, from a remot...

The vulnerability of the ImageIO component in Mac OS operating systems allows a hacker to execute arbitrary code.

The vulnerability of the ImageIO component in Mac OS operating systems is related to writing beyond buffer boundaries in memory, as well as to operations beyond buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using malicious web conten...

The vulnerability of the web page rendering module in WebKit operating systems for tvOS, iOS, iPadOS, and watchOS allows attackers to execute arbitrary code.

The vulnerability of the Web page rendering module in WebKit operating systems for tvOS, iOS, iPadOS, and watchOS is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code using malicious web content...

The vulnerability of the libxml2 library in Mac OS operating systems allows attackers to execute arbitrary code.

The vulnerability of the libxml2 library in Mac OS operating systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created malicious web content...

The vulnerability of the Web page rendering module in WebKitGTK and the WPE port of WebKit operating systems on Mac OS, related to the use of memory after it is freed, allows attackers to execute arbitrary code.

The vulnerability of the Web page rendering module in WebKitGTK and the WPE port of WebKit operating systems on Mac OS is related to the use of memory after it is freed. Exploiting this vulnerability can allow attackers to execute arbitrary code using specially created malicious web content...

VulnCheck KEV: CVE-2021-30762

Apple iOS WebKit contains a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML...

VulnCheck KEV: CVE-2021-30761

Apple iOS WebKit contains a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML...

U.S. Dept Of Defense: XSS Reflected - ██████████

Hi Team, I found a XSS Reflected. https://██████████/███onload=%22prompt1 Thanks DRauschkolb Impact XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content & even steal cookies. System Host...

U.S. Dept Of Defense: XSS Reflected - ███

Hi Team, I found a XSS Reflected. https://██████/Telerik.ReportViewer.axd?optype=Parameters&bgColor=000000%22onload=%22prompt1 Thans DRauschkolb Impact XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or...

SQL Injection Vulnerability in CmsEasy of Siping Jiuzhou Yitong Technology Co. Ltd (CNVD-2021-40740)

CmsEasy is a web content management system based on PHP Mysql architecture and a PHP development platform. CmsEasy has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

Apple Safari 跨站脚本漏洞

Apple Safari is a web browser from Apple, Inc. and is the default browser that comes with Mac OS X and iOS operating systems. A cross-site scripting vulnerability exists in Apple Safari. The vulnerability stems from the fact that processing maliciously crafted web content may result in cross-site...

Exploit for Use After Free in Microsoft

CVE-2021-31166 is a remote code execution vulnerability in the HTTP protocol stack. It is a use-after-free dereference bug in the http!UlpParseContentCoding function. The bug occurs when the function appends items to a local list and then moves it into the Request structure without NULLing out th...

python: Unsafe use of eval() on data retrieved via HTTP in the test suite

In Python3's Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...

webkitgtk: Memory initialization issue possibly leading to memory disclosure

A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. Processing maliciously crafted web content may result in the disclosure of process memory...