The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.0%.
Denial Of Service
Buffer Overflow
Nginx
Memory Corruption
RCE
+1
NVD
GitHub
Exploit-DB
CVSS 2.0
7.5
EPSS
93.0%
Threat
5.8
SQL injection vulnerability in the News Search (news_search) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQLi
News Search
NVD
CVSS 2.0
7.5
EPSS
0.4%