PT-2021-17105

Name of the Vulnerable Software and Affected Versions Redwood Report2Web versions 4.3.4.5 through 4.5.3 Description A frame-injection issue in the online help of Redwood Report2Web allows remote attackers to render an external resource inside a frame via the "help/Online Help/NetHelp/default.htm"...

Qualcomm WLAN HOST Resource Management Error Vulnerability

Qualcomm WLAN HOST is a Qualcomm Incorporated USA wireless LAN component used in Qualcomm products. A resource management error vulnerability exists in the Qualcomm WLAN HOST, which arises from the possibility that an entry in the hash table could be deleted before a frame is placed in the PE que...

Qualcomm WLAN HOST Security Vulnerability

Qualcomm WLAN HOST is a Qualcomm Incorporated USA wireless LAN component used in Qualcomm products. A security vulnerability exists in the Qualcomm WLAN HOST that stems from improper checking of logical subtypes, resulting in too many frames being discarded...

CentOS 8 : firefox (CESA-2020:3557)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3557 advisory. - Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer CVE-2020-12422 - Mozilla: WebRTC permission prompt could have been bypassed by a...

PT-2021-28032

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, as indicated by the crash type. The crash state involves functions such as blosc getitem, get coffset,...

CentOS 8 : kernel (CESA-2019:2703)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2703 advisory. - kernel: Use-after-free in sound/usb/card.c:usbaudioprobe CVE-2018-19824 - kernel: Count overflow in FUSE request leading to use-after-free issues...

PT-2021-28031

Name of the Vulnerable Software and Affected Versions blosc2 affected versions not specified Description The issue is related to a crash type known as Memcpy-param-overlap. Technical details about the crash state include the involvement of specific functions: frame get usermeta, blosc2 frame to...

CVE-2020-26272

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame,...

Electron Security Vulnerabilities

Electron is Electron open source a user to write cross-platform desktop application JavaScript framework. The framework is based on nodejs and Chromium can use HTML, CSS to achieve cross-platform desktop application writing. Electron has a security vulnerability , the vulnerability stems from in...

CVE-2020-26272: Exposure of Resource to Wrong Sphere

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame,...

PT-2021-11228

Name of the Vulnerable Software and Affected Versions: Electron versions prior to 9.4.0 Electron versions prior to 10.2.0 Electron versions prior to 11.1.0 Electron versions prior to 12.0.0-beta.9 Description: IPC messages sent from the main process to a subframe in the renderer process, through...

Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have been

The Mozilla Foundation Security Advisory describes this flaw as: When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to...

Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have been

The Mozilla Foundation Security Advisory describes this flaw as: When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to...

c-blosc2:decompress_frame_fuzzer: Memcpy-param-overlap in frame_get_usermeta

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5035219092635648 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...

c-blosc2:decompress_frame_fuzzer: Crash in blosc_getitem

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5005175230169088 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x407b28...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in blosc_d

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5079034688045056 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasanc-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Addres...

PT-2021-9184

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon affected versions not specified Description The issue is related to out of bound memory access while processing frames due to a lack of check for invalid frames received. This affects various Qualcomm Snapdragon products,...

CVE-2020-11139: Out-of-bounds Write

Out of bound memory access while processing frames due to lack of check of invalid frames received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

PT-2021-28009

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the functions blosc getitem, get coffset, and frame get lazychunk. Recommendation...

c-blosc2:decompress_frame_fuzzer: Heap-buffer-overflow in blosc_getitem

Project: https://github.com/Blosc/c-blosc2.git Detailed Report: https://oss-fuzz.com/testcase?key=5107539828146176 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzerasani386c-blosc2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...