CVE-2021-21359

TYPO3 core vulnerability CVE-2021-21359 affects TYPO3 CMS before 9.5.25, 10.4.14, and 11.1.1. When a user requests invalid or non-existing resources via HTTP, the page error handler could retrieve content to display from another page, causing the application to call itself recursively and potenti...

CVE-2021-21370

TYPO3 core contains a cross-site scripting (XSS) vulnerability in content elements of type menu when their referenced items are previewed in the page module. A valid backend user account is required to exploit. Affected versions are TYPO3 before 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1; remedi...

CVE-2021-21339 Cleartext storage of session identifier

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited...

CVE-2021-21339

CVE-2021-21339 affects TYPO3, a PHP-based CMS. The issue is that user session identifiers were stored in cleartext in versions prior to 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The root cause is storage of session identifiers without additional cryptographic hashing, and exploitation ...

CVE-2021-21340

TYPO3 core vulnerability CVE-2021-21340: In TYPO3 versions earlier than 10.4.14 and 11.1.1, database fields used as descriptionColumn could be exploited for cross-site scripting when content is previewed. A valid backend user is required to exploit. The issue is fixed in TYPO3 10.4.14 and 11.1.1....

CVE-2021-21355

TYPO3 8.7.40, 9.5.25, 10.4.14, 11.1.1 fix a file-upload vulnerability where UploadedFileReferenceConverter can accept any mime-type for certain Extbase-based uploads, allowing attackers to place arbitrary files under /fileadmin/user_upload/ (and potentially reference/guess filenames). Impact stat...

CVE-2021-21357

TYPO3 Form Framework vulnerability (CVE-2021-21357): Improper input validation in Form Designer enables bypass of predefined option restrictions, allowing upload of arbitrary MIME types and persistence of files in writable TYPO3 directories. Requires a valid backend user to exploit. Affects TYPO3...

CVE-2021-21358

TYPO3 CMS is affected by a cross-site scripting (XSS) vulnerability in the Form Designer backend module of the Form Framework. The issue exists in TYPO3 versions before 10.4.14 and 11.1.1, and requires a valid backend user account with access to the Form module to exploit. It is fixed in versions...

DynPG 安全漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "page" parameter...

Dynpg组织 Dynpg 跨站脚本漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "query" parameter...

macOS 11.x < 11.2.3 (HT212220)

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.2.3 Big Sur. It is, therefore, affected by a memory corruption issue due to insufficient validation. An attacker can exploit this with crafted web content to cause arbitrary code execution. Note that Nessus has not...

Deserialization vulnerability in kitecms

KiteCMS is an open source web content management system CMS, the system is based on the framework ThinkPHP5.1. version of the development of the system, for individuals and enterprises to quickly build a station and development needs. Kitecms has a deserialization vulnerability that can be...

Apple Issues Patch for Remote Hacking Bug Affecting Billions of its Devices

Apple has released out-of-band patches for iOS, macOS, watchOS, and Safari web browser to address a security flaw that could allow attackers to run arbitrary code on devices via malicious web content. Tracked as CVE-2021-1844, the vulnerability was discovered and reported to the company by Clémen...

Apple Issues Patch for Remote Hacking Bug Affecting Billions of its Devices

Apple has released out-of-band patches for iOS, macOS, watchOS, and Safari web browser to address a security flaw that could allow attackers to run arbitrary code on devices via malicious web content. Tracked as CVE-2021-1844 , the vulnerability was discovered and reported to the company by Cléme...

Command Execution Vulnerability in KiteCMS

KiteCMS open source web content management system CMS, the system is based on the framework ThinkPHP 5.1. version of the development, applicable to individuals and enterprises to quickly build a station and development needs. KiteCMS command execution vulnerability , an attacker can exploit the...

SeaCMS suffers from SQL injection vulnerability (CNVD-2021-17447)

SeaCMS is a web content management system based on PHP MYSQL architecture and can run across platforms. SeaCMS has a SQL injection vulnerability that can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in MKCMS Official Version

MKCMS is a free and open source PHP web content management system developed by Yakun Technology. MKCMS official version of the existence of SQL injection vulnerability , attackers can use the vulnerability to obtain sensitive information in the database...

Debian DSA-4854-1 : webkit2gtk - security update

The following vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2020-13558 Marcin Noga discovered that processing maliciously crafted web content may lead to arbitrary code execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

[SECURITY] Fedora 33 Update: privoxy-3.0.31-1.fc33

Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, filtering web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit...

Remote Code Execution

webkit2gtk3 is vulnerable to remote code execution. Multiple memory corruption issues were addressed with improved memory handling. Processing maliciously crafted web content may lead to arbitrary code execution...