Unauthenticated remote code execution in Ignition

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2...

USN-4862-1 neovim vulnerability

It was discovered that Neovim incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code...

USN-4817-1 hdf5 vulnerabilities

It was discovered that HDF5 incorrectly handled certain hdf5 files. An attacker could possibly use this issue to cause a denial of service...

Design/Logic Flaw

Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...

CVE-2021-21068

Adobe Creative Cloud Desktop Application (Windows/macOS) 5.3 and earlier is affected by a file-handling vulnerability that can lead to arbitrary file overwriting. Exploitation requires physical access and user interaction (local/physical vector). Multiple sources indicate broader impact that coul...

CVE-2021-21068 Adobe Creative Cloud installer arbitrary file overwrite vulnerability

Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...

CVE-2021-21068 Adobe Creative Cloud installer arbitrary file overwrite vulnerability

Adobe Creative Cloud Desktop Application version 5.3 and earlier is affected by a file handling vulnerability that could allow an attacker to cause arbitrary file overwriting. Exploitation of this issue requires physical access and user interaction...

CVE-2021-21381

A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity. Mitigation...

Security Vulnerabilities fixed in Firefox 86 — Mozilla

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...

OSV-2021-361 Stack-buffer-overflow in add_file

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30774 Crash type: Stack-buffer-overflow WRITE Crash state: addfile strfilenamecb handleoption...

Foxit Studio Photo 缓冲区错误漏洞

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. An information disclosure vulnerability exists in the handling of CMP files in Foxit Studio Photo 3.6.6.930 and earlier versions. The vulnerability stems from a lack of proper validation of user-supplied...

Foxit Studio Photo 缓冲区错误漏洞

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A remote code execution vulnerability exists in the handling of EZIX files in Foxit Studio Photo 3.6.6.930 and earlier versions. An attacker can exploit this vulnerability by tricking a user into visiting ...

Foxit Studio Photo 缓冲区错误漏洞

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. An information disclosure vulnerability exists in the handling of CMP files in Foxit Studio Photo 3.6.6.930 and earlier versions. The vulnerability stems from a lack of proper validation of user-supplied...

DEBIAN-CVE-2021-26220

The ezxmltoxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool...

CVE-2021-22637

Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite versions prior to 4.0.10.0...

CVE-2021-3129

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2...

Code injection

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2...

CVE-2021-3129

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2...

[slackware-security] sudo

New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/sudo-1.9.5-i586-1slack14.2.txz: Upgraded. This update fixes security issues: Potential information leak in sudoedit that...

USN-4688-1 jasper vulnerabilities

It was discovered that Jasper incorrectly certain files. An attacker could possibly use this issue to cause a crash. CVE-2018-18873 It was discovered that Jasper incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. CVE-2018-19542 It was...