WordPress cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Floating Social Media Icon plugin has a...

November 22, 2021—KB5007262 (OS Build 22000.348) Preview

None None...

CVE-2020-23887

XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service DoS via a crafted ico file. Related to a Read Access Violation starting at USER32!SmartStretchDIBits+0x33...

WildBit Viewer buffer error vulnerability

WildBit Viewer is a compact image viewer with slide show and editor. A buffer overflow vulnerability exists in WildBit Viewer version 6.6, which can be exploited by an attacker to cause a denial of service via a specially crafted ico file...

python-pillow: Excessive memory allocation in ICO image reader

A flaw was found in python-pillow. Attackers can cause a denial of service memory consumption because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large...

python-pillow: Excessive memory allocation in ICNS image reader

A flaw was found in python-pillow. Attackers can cause a denial of service memory consumption because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2020-5312 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2020-5312 Source advisory:...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2020-10378 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2020-10378 Source advisory:...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2020-5310 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2020-5310 Source advisory:...

NewStart CGSL MAIN 6.02 : firefox Multiple Vulnerabilities (NS-SA-2021-0131)

The remote NewStart CGSL host, running version MAIN 6.02, has firefox packages installed that are affected by multiple vulnerabilities: - Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as...

brython-server (>=2.0.3, <=2.2.1), cimage (>=1.4.1, <=1.4.2) +7 more potentially affected by CVE-2021-34552 via pillow (2.9.0)

pillow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - brython-server =2.0.3, =1.4.1, =0.0.1, =1.0.7, =0.6.1, =0.1.1, =0.5.28, =0.0.1.dev0, =1.0.0b1 Source cves: CVE-2021-34552 Source advisory:...

USN-5099-1 imlib2 vulnerability

It was discovered that Imlib2 incorrectly handled certain ICO images. An attacker could use this issue to cause a denial of service and possibly execute arbitrary code...

CVE-2021-24634

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perfor...

Uber security alert scam spoofs real Uber number—Watch out!

This morning Malwarebytes Labs received a scam masquerading as a security alert from Uber. The alert was pretty convincing and used the kind of language were used to seeing in genuine security emails and SMS messages. It read: Your Uber account was recently logged into from iPhone in London. If...

PS2EXE - Module To Compile Powershell Scripts To Executables

Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. With Powershell 5.x support and graphical front end. Module version. You find the script based version here...

CVE-2021-39836

Acrobat Reader DC versions 2021.005.20060 and earlier, 2020.004.30006 and earlier and 2017.011.30199 and earlier are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the context of the current user...

Null pointer deference in fltk

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon...

GHSA-7QCC-G2M9-8533 Null pointer deference in fltk

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon...

CVE-2021-24519

The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24519

The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue...