Why I Love (Breaking Into) Your Security Appliances

Amid the Colonial Pipeline and JBS ransomware attacks that sparked shockwaves among media worldwide, news broke that attackers were able to compromise Colonial Pipeline through a legacy VPN account. The account lacked multifactor authentication MFA and wasn’t in active use within the business, a...

freetype2:colrv1: Heap-buffer-overflow in tt_face_get_paint_layers

Detailed Report: https://oss-fuzz.com/testcase?key=4990722490105856 Project: freetype2 Fuzzing Engine: afl Fuzz Target: colrv1 Job Type: aflasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62a000012546 Crash State: ttfacegetpaintlayers FTGetPaintLayers...

DEBIAN-CVE-2021-28675

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load...

ALPINE-CVE-2021-28675

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load...

CVE-2021-28675

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load...

PYSEC-2021-139

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load...

UBUNTU-CVE-2021-28675

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load...

OSV-2021-719 Heap-buffer-overflow in tt_face_get_paint_layers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33855 Crash type: Heap-buffer-overflow READ 1 Crash state: ttfacegetpaintlayers FTGetPaintLayers colrv1traversepaint...

PT-2021-28242

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 1 crash has been reported. The crash involves the tt face get paint layers and FT Get Paint Layers functions, as well as the...

Security Bug Allows Attackers to Brick Kubernetes Clusters

A vulnerability in one of the Go libraries that Kubernetes is based on could lead to denial of service DoS for the CRI-O and Podman container engines. The bug CVE-2021-20291 affects the Go library called “containers/storage.” According to Aviv Sasson, the security researcher at Palo Alto’s Unit 4...

container-tools:2.0 security update

buildah 1.11.6-8.0.1 - Reduce unnecessary writable mounts in NaiveDiffDriver Orabug: 31025483 - Fixes troubles with oracle registry login Orabug: 29937283 1.11.6-8 - exclude i686 arch - Related: 1821193 1.11.6-7 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file...

CVE-2021-23976: Improper Restriction of Rendered UI Layers or Frames

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on...

The vulnerability of the Downloads function in Google Chrome web browsers allows a hacker to circumvent existing security restrictions.

The vulnerability of the Downloads function in the Google Chrome web browser is related to an improper limitation on the displayed layers of the user interface. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

The vulnerability of the DevTools set of tools in the Google Chrome web browser allows a hacker to bypass existing security restrictions.

The vulnerability of the DevTools set of tools in the Google Chrome web browser is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

Code Injection in tensorlayer/tensorlayer

Description TensorLayer is a novel TensorFlow-based deep learning and reinforcement learning library designed for researchers and engineers. It provides an extensive collection of customizable neural layers to build advanced AI models quickly. This package is vulnerable to Arbitrary Code Executio...

The vulnerability in the Google Chrome web interface allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of Google Chrome’s web interface is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2020-16032: Improper Restriction of Rendered UI Layers or Frames

Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...

CVE-2020-28218

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to trick a user into initiating an unintended action...

CVE-2020-28218: Improper Restriction of Rendered UI Layers or Frames

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 firmware 2.7 and older, that would allow an attacker to trick a user into initiating an unintended action...

CVE-2020-26953: Improper Restriction of Rendered UI Layers or Frames

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox 83, Firefox ESR 78.5, and Thunderbird 78.5...