Vulnerabilities (CVE)

TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1.

A weakness has been identified in diyhi bbs up to 6.8. The impacted element is an unknown function of the file src/main/java/cms/web/action/filePackage/FilePackageManageAction.java of the component File Compression Handler. This manipulation of the argument idGroup causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.

Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are ... Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

Show More

Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.

Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.

Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.

Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.

Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*.

Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.

Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.

Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.

Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability

Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Edge for Android Spoofing Vulnerability

Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability

Visual Studio Code Remote Code Execution Vulnerability

Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability

Azure DevOps Server and Team Foundation Services Spoofing Vulnerability

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft Exchange Remote Code Execution Vulnerability

Microsoft Exchange Remote Code Execution Vulnerability

Windows SMB Information Disclosure Vulnerability

Windows Overlay Filter Security Feature Bypass Vulnerability

Windows Error Reporting Information Disclosure Vulnerability

DirectX Graphics Kernel Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Azure DevOps Server Spoofing Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Microsoft Exchange Remote Code Execution Vulnerability

Microsoft Excel Security Feature Bypass Vulnerability

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Excel Remote Code Execution Vulnerability