CVE-2021-42576

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python in pybluemonday, does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...

Sanitize 输入验证错误漏洞

Sanitize is an HTML and CSS cleaner by Ryan Grove, an individual developer in the United States, which supports removing HTML and CSS from strings, among other things. Sanitizer suffers from an input validation error vulnerability that stems from OWASP Java HTML Sanitizer before 20211018.1 not...

PT-2021-23638 · Owasp · Owasp Java Html Sanitizer

Name of the Vulnerable Software and Affected Versions: OWASP Java HTML Sanitizer versions prior to 20211018.1 Description: The issue is related to the improper enforcement of policies associated with the SELECT, STYLE, and OPTION elements. This affects the OWASP Java HTML Sanitizer...

David Kitchen bluemonday 安全漏洞

David Kitchen bluemonday is a David Kitchen open source application . HTML cleaner for implementation in Go. A security vulnerability exists in bluemonday sanitizer, which originates in bluemonday before 1.0.16 in Go and before 0.0.8 in Python in pybluemonday, that does not correctly enforce the...

PT-2021-23639 · Unknown +1 · Bluemonday +1

Name of the Vulnerable Software and Affected Versions: bluemonday versions prior to 1.0.16 for Go bluemonday versions prior to 0.0.8 for Python in pybluemonday Description: The bluemonday sanitizer does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements,...

OSV-2021-1449 UNKNOWN WRITE in void QtPrivate::QPodArrayOps<QPainterPath::Element>::emplace<QPainterPath::Eleme

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39957 Crash type: UNKNOWN WRITE Crash state: void QtPrivate::QPodArrayOps::emplaceQPainterPath::Eleme QPainterPath::lineTo QOutlineMapper::clipElements...

CVE-2021-35982

CVE-2021-35982 affects Adobe Acrobat Reader DC and related products, with an Uncontrolled Search Path Element leading to DLL hijacking and arbitrary code execution in the current user context. Root cause: vulnerable DLL search path handling enables a local attacker with non-administrative privile...

Information Disclosure

riot-web is vulnerable to information disclosure.A logic error in the room key sharing functionality of Element Android allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were originally sent by affected Matrix...

matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver

Impact A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-en...

[ASA-202109-5] element-web: information disclosure

Arch Linux Security Advisory ASA-202109-5 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-40823 Package : element-web Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2377 Summary ======= The package element-web befo...

FreeBSD : Matrix clients -- several vulnerabilities (93eb0e48-14ba-11ec-875e-901b0e9408dc)

Matrix developers report : Today we are disclosing a critical security issue affecting multiple Matrix clients and libraries including Element Web/Desktop/Android, FluffyChat, Nheko, Cinny, and SchildiChat. Specifically, in certain circumstances it may be possible to trick vulnerable clients into...

Adobe Acrobat < 2017.011.30202 / 2020.004.30015 / 2021.007.20091 Multiple Vulnerabilities (APSB21-55)

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 2017.011.30202, 2020.004.30015, or 2021.007.20091. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader DC versions 2021.005.20060 and earlier, 2020.004.30006 and earlier and 2017.011.30199...

Adobe Reader < 2017.011.30202 / 2020.004.30015 / 2021.007.20091 Multiple Vulnerabilities (APSB21-55)

The version of Adobe Reader installed on the remote Windows host is a version prior to 2017.011.30202, 2020.004.30015, or 2021.007.20091. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader DC versions 2021.005.20060 and earlier, 2020.004.30006 and earlier and 2017.011.30199...

[ASA-202109-4] element-desktop: information disclosure

Arch Linux Security Advisory ASA-202109-4 ========================================= Severity: High Date : 2021-09-14 CVE-ID : CVE-2021-40823 Package : element-desktop Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2377 Summary ======= The package...

3gtel-frontend-platform (=1.0.0), @achieve-all/v-element (=1.0.0) +1000 more potentially affected by CVE-2021-23440 via set-value (>=0.1.6 <=1.0.0)

set-value NPM version =0.1.6, =5.0.0, =4.0.2, =0.1.1, =1.0.0, =1.0.0, =1.1.0, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =2.0.0, =2.0.16 and more Source cves: CVE-2021-23440 Source advisory: OSV:GHSA-4JQC-8M5R-9RPR...

CVE-2021-40824

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were...

CVE-2021-40824

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were...

Code injection

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were...

CVE-2021-40824

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were...

CVE-2021-40824

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 aka Matrix SDK for Android before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were...