CVE-2023-25442

CVE-2023-25442 affects the WordPress Zeno Font Resizer plugin up to version 1.7.9. It is a stored XSS vulnerability requiring admin+ authentication. The issue is fixed in version 1.8.0; remediation is to update the plugin to 1.8.0 or later.

CVE-2023-25442 WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

CVE-2023-25442: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Marcel Pol Zeno Font Resizer plugin = 1.7.9 versions...

PT-2023-20064 · Unknown · Marcel Pol Zeno Font Resizer

Name of the Vulnerable Software and Affected Versions: Marcel Pol Zeno Font Resizer plugin versions = 1.7.9 Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For versions = 1.7....

WordPress Plugin Zeno Font Resizer has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-8416 · Apple · Macos Monterey +5

Name of the Vulnerable Software and Affected Versions: macOS Big Sur versions prior to 11.7.5 macOS Ventura versions prior to 13.3 macOS Monterey versions prior to 12.6.4 iOS versions prior to 16.4 iOS versions prior to 15.7.4 iPadOS versions prior to 16.4 iPadOS versions prior to 15.7.4...

CVE-2023-25861 Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-25860 Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-25860 Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2023-25862 Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interacti...

CVE-2023-25862 Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Illustrator version 26.5.2 and earlier and 27.2.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interacti...

Medium: kernel

Issue Overview: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. CVE-2022-4129 A...

Implementation error in Namespace.fuse() leads to a wrong unicode representation

Lines of code Vulnerability details Impact The font class of a tile will be always considered as 0 emoji when a user registers a name. Proof of Concept To register a name, fuse is used taking as input the data of the characters. The name to register is a string created by converting the character...

PT-2023-5270

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 112 Firefox for Android versions prior to 112 Focus for Android versions prior to 112 Description The issue is related to multiple race conditions in the font initialization, which could lead to memory corruption and...

Fuse function only allows creation of emoji typed characters, and does not allow creation of other font classes like text.

Lines of code Vulnerability details Impact The fuse function only allows creation of emoji typed characters due to this line in the fuse function: bytes memory charAsBytes = Utils.characterToUnicodeBytes0, tileData.characterIndex, characterModifier;, which only accepts a fontClass of 0 as the fir...

Namespace: Fusing will only result in namespaces containing font class 0, irrelevant of fused tiles

Lines of code Vulnerability details H-02 Namespace: Fusing will only result in namespaces containing font class 0, irrelevant of fused tiles After minting trays, a user can fuse tiles from multiple trays into a namespace. A tray tile specifies a character font class, the character's index and the...

Incorrect argument passed to "Utils.characterToUnicodeBytes" in "Namespace.fuse"

Lines of code Vulnerability details Impact The function Namespace.fuse uses Utils.characterToUnicodeBytes to get the unicode bytevalue for a given Tile. The first argument of characterToUnicodeBytes is an uint8 value representing the font class. Instead of passing the font class in the tile data,...

User can fuse an NFT with minimal cost

Lines of code Vulnerability details Impact User can fuse an NFT with minimal cost Proof of Concept The fuse is used to fuse a new Namespace NFT with the referenced tiles,if it is called, the protocol will transfer fusing costs from msg.sender to revenue address. The fusing costs is calculated...

Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe Illustrator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Illustrator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...