CVE-2023-25442

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

CVE-2023-25442

CVE-2023-25442 affects the WordPress Zeno Font Resizer plugin up to version 1.7.9. It is a stored XSS vulnerability requiring admin+ authentication. The issue is fixed in version 1.8.0; remediation is to update the plugin to 1.8.0 or later.

CVE-2023-25442 WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

CVE-2023-25442 WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

WordPress Plugin Zeno Font Resizer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-20064 · Unknown · Marcel Pol Zeno Font Resizer

Name of the Vulnerable Software and Affected Versions: Marcel Pol Zeno Font Resizer plugin versions = 1.7.9 Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For versions = 1.7....

PT-2023-8416 · Apple · Macos Monterey +5

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions prior to 11.7.5 macOS Ventura versions prior to 13.3 macOS Monterey versions prior to 12.6.4 iOS versions prior to 16.4 iOS versions prior to 15.7.4 iPadOS versions prior to 16.4 iPadOS versions prior to 15.7.4...

CVE-2023-25862 Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interacti...

CVE-2023-25860 Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-25860 Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-25861 Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-25862 Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interacti...

Medium: kernel

Issue Overview: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. CVE-2022-4129 A...

Namespace: Fusing will only result in namespaces containing font class 0, irrelevant of fused tiles

Lines of code Vulnerability details H-02 Namespace: Fusing will only result in namespaces containing font class 0, irrelevant of fused tiles After minting trays, a user can fuse tiles from multiple trays into a namespace. A tray tile specifies a character font class, the character's index and the...

Fuse function only allows creation of emoji typed characters, and does not allow creation of other font classes like text.

Lines of code Vulnerability details Impact The fuse function only allows creation of emoji typed characters due to this line in the fuse function: bytes memory charAsBytes = Utils.characterToUnicodeBytes0, tileData.characterIndex, characterModifier;, which only accepts a fontClass of 0 as the fir...

Implementation error in Namespace.fuse() leads to a wrong unicode representation

Lines of code Vulnerability details Impact The font class of a tile will be always considered as 0 emoji when a user registers a name. Proof of Concept To register a name, fuse is used taking as input the data of the characters. The name to register is a string created by converting the character...

Incorrect argument passed to "Utils.characterToUnicodeBytes" in "Namespace.fuse"

Lines of code Vulnerability details Impact The function Namespace.fuse uses Utils.characterToUnicodeBytes to get the unicode bytevalue for a given Tile. The first argument of characterToUnicodeBytes is an uint8 value representing the font class. Instead of passing the font class in the tile data,...

User can fuse an NFT with minimal cost

Lines of code Vulnerability details Impact User can fuse an NFT with minimal cost Proof of Concept The fuse is used to fuse a new Namespace NFT with the referenced tiles,if it is called, the protocol will transfer fusing costs from msg.sender to revenue address. The fusing costs is calculated...

Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Illustrator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...

Adobe Illustrator Font Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Illustrator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...