accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in userchangeiconfileauthorizedcb in user.c...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-23726)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the handling of the attachIcon attribute of the Annotation object in Foxit Reader...

Memory Corruption Vulnerability in Softmedia Icon Master, Softmedia Magic, Qingdao (CNVD-2018-19757)

Softmedia Icon Master is an icon management software with functions such as icon extraction, icon replacement, icon format conversion and icon cache repair. There is a memory corruption vulnerability in Softmedia Icon Master, which allows an attacker to cause the program to crash by constructing...

Memory Corruption Vulnerability in Softmedia Icon Master of Qingdao Softmedia Magic Cube

Softmedia Icon Master is an icon management software with functions such as icon extraction, icon replacement, icon format conversion and icon cache repair. There is a memory corruption vulnerability in Softmedia Icon Master, which allows an attacker to cause the program to crash by constructing...

XnView Denial of Service Vulnerability (CNVD-2019-10273)

XnView is a multi-platform software that supports image viewing, conversion and editing. A denial of service vulnerability exists in XnView 2.45, which can be exploited by remote attackers to cause a denial of service via a specially crafted ICO file...

Microsoft Windows SCF File Feature Bypass

Exploit Title: Microsoft Windows 'SCF' File 'Open File Security Warning' Feature Bypass Vulnerability Google Dork: N/A Date: August 3, 2018 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: http://www.microsoft.com/ Version: Windows 7 SP1, 8.1 with full...

Buffer Overflow Vulnerability in MyQuickView

MyQuickView is a powerful foreign image viewer and browser. MyQuickView is a powerful foreign image viewer and browser. The tool suffers from a buffer overflow arbitrary code execution vulnerability when processing ICO images. An attacker can cause arbitrary code execution by constructing a...

CVE-2018-14036

CVE-2018-14036 : Affected component is AccountsService (before 0.6.50) with an insufficient path check in user_change_icon_file_authorized_cb() in user.c, enabling a directory traversal via ../ sequences. Public references in Ubuntu USN-4616-1, SUSE/SUSE-SU advisories, and OpenVAS/Nessus entries ...

​StoreFront Shows Blank Icons for Published Applications

StoreFront shows blank icons for the published applications. This issue occurs after introducing a new secondary store in the environment. If we clear out the icon cache and reset IIS storeWeb\AppData\CtxsWebProxyIconCache, the issue gets fixed temporarily...

Cinnamon Design Vulnerability

Cinnamon is an open source desktop environment for Linux. A security vulnerability exists in Cinnamon versions 1.9.2 through 3.8.6, which originates from the cinnamon-settings-users.py GUI that can be run with root privileges and configure other users' icon files. The vulnerability can be exploit...

UBUNTU-CVE-2018-13054

An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of for example other users' icon files in onfacebrowsemenuitemactivated and onfacemenuitemactivated. These icon files are written to the respective user's $HOME/.face...

CVE-2018-13054

An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of for example other users' icon files in onfacebrowsemenuitemactivated and onfacemenuitemactivated. These icon files are written to the respective user's $HOME/.face...

DEBIAN-CVE-2018-13054

An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of for example other users' icon files in onfacebrowsemenuitemactivated and onfacemenuitemactivated. These icon files are written to the respective user's $HOME/.face...

CVE-2018-13054

CVE-2018-13054 affects Cinnamon 1.9.2–3.8.6 where cinnamon-settings-users.py runs as root and can overwrite any user’s ~/.face via symlink pointing to an arbitrary location, enabling a possible privilege escalation. Connected advisories (openSUSE, Fedora, SUSE, Mageia, Ubuntu) report a fix for th...

U.S. Dept Of Defense: Partial PII leakage due to public set gitlab

Summary: ████████ allows you to explore the repos, snippets,etc. On the snippets we find a name+icon and some code information. This shouldn't publicly exposed as an attacker may use it to perform further attacks Description: A configuration issue allows code and the name+icon of a user on the...

CVE-2018-12999

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI...

How to customize the storefront website title

Customize the storefront website title and the icon...

Error: "Cannot Complete Your Request" After Publishing New App or Customizing App’s Icon on StoreFront

The following error is displayed after publishing a new application or customizing an application’s icon on StoreFront: Cannot Complete Your Request...

jira.unite.un.org XSS vulnerability

Open Bug Bounty ID: OBB-630879 Description| Value ---|--- Affected Website:| jira.unite.un.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-5140

Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This could allow for information leakage of which applications are associated with specific MIME types by a malicious page. This vulnerability affects Firefox 59...