OSV-2021-719 Heap-buffer-overflow in tt_face_get_paint_layers

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33855 Crash type: Heap-buffer-overflow READ 1 Crash state: ttfacegetpaintlayers FTGetPaintLayers colrv1traversepaint...

PT-2021-3371 · Microsoft · Paint 3D

Name of the Vulnerable Software and Affected Versions: Paint 3D affected versions not specified Description: The issue is related to a buffer overflow in memory when parsing PLY files, which can allow an attacker to execute arbitrary code using a specially crafted malicious file or link...

PT-2021-3370 · Microsoft · Paint 3D

Name of the Vulnerable Software and Affected Versions: Paint 3D affected versions not specified Description: The issue is related to a buffer overflow in memory when parsing GLB files, which can allow an attacker to execute arbitrary code using a specially crafted malicious file or link...

PT-2021-3368 · Microsoft · Paint 3D

Name of the Vulnerable Software and Affected Versions: Paint 3D affected versions not specified Description: The issue is related to an out-of-bounds buffer operation in memory when parsing GLB and STL files, which can be exploited by an attacker to execute arbitrary code using a specially crafte...

Stacking CDNs for Improved Performance and Security

I recently worked with a client whose large e-commerce site was hosted with a popular cloud-based commerce solution. Its business was growing rapidly into new geographic markets, and it was not satisfied with the embedded content delivery network eCDN that was bundled with the cloud solution. We...

CSS paint API: Being predictably random

Take a look at this: Space invaders If you're using a browser that supports the CSS paint API, the element will have a 'random' pixel-art gradient in the background. But it turns out, doing random in CSS isn't as easy as it seems… Initial implementation This isn't a full tutorial on the CSS paint...

Timers, Metrics, and Dimensions: What's New in mPulse in 2020

The October 2020 release marks the culmination of a large number of updates to mPulse, Akamai's real user monitoring RUM solution: 8 New timers 2 New metrics 5 New dimensions UI improvements Extra custom timer capabilities With all of these new changes, you can easily determine and tune the...

Measuring & Improving Core Web Vitals

Google recently announced a proposed update to its search ranking algorithm: the Page Experience Update. This change, which launches in 2021, includes more performance signals in the ranking algorithm. A subtle but important feature of the update is that AMP will no longer be a requirement for...

applicators.haymespaint.com.au Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1161418 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Microsoft Issues Out-Of-Band Security Update For Office, Paint 3D

Microsoft has released an out-of-band security update for Microsoft Office, Office 365 ProPlus and Paint 3D. The applications are affected by multiple Autodesk vulnerabilities that, if exploited, could enable remote code execution. The flaws, all rated “important” in severity, are tied to six CVE...

Microsoft Releases Security Updates for Multiple Products

Microsoft has released security updates to address multiple vulnerabilities in products that use the Autodesk FBX library. These include Office 2016, Office 2019, Office 365 ProPlus, and Paint 3D. A remote attacker can exploit these vulnerabilities to take control of an affected system. The...

paint-inspector.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1082000 Security Researcher sardharabadal Helped patch 277 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting paint-inspector.com...

paint-inspector.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1080699 Security Researcher sardharabadal Helped patch 274 vulnerabilities Received 3 Coordinated Disclosure badges Received 3 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting paint-inspector.com...

paint-inspector.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1077683 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

The vulnerability in the implementation of the API technology used by CSS Paint in the Google Chrome browser allows attackers to disclose protected information.

The vulnerability of the API implementation in Google Chrome’s CSS Paint technology lies in the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information through a specially created HTML page...

CVE-2019-12897

Edraw Max 7.9.3 has a Read Access Violation at the Instruction Pointer after a call from ObjectModule!Paint::Clear+0x0000000000000074...

CVE-2019-12897

Edraw Max 7.9.3 has a Read Access Violation at the Instruction Pointer after a call from ObjectModule!Paint::Clear+0x0000000000000074...

CVE-2019-12897

CVE-2019-12897 affects Edraw Max 7.9.3. The vulnerability is described as a Read Access Violation at the Instruction Pointer triggered after a call from ObjectModule!Paint::Clear+0x... (address provided). Connected sources corroborate this description across multiple feeds; no additional technica...

Paint Studio 2.17 - Denial of Service Exploit

Exploit Title: Paint Studio 2.17 - Denial of Service PoC Exploit Author: Ihsan Sencan Vendor Homepage: http://www.pixarra.com/ Software Link: http://www.pixarra.com/uploads/9/4/6/3/94635436/tbpaintstudioinstall.exe Version: 2.17 Category: Dos Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A POC: 1 Paint...

Paint Studio 2.17 Denial Of Service

Exploit Title: Paint Studio 2.17 - Denial of Service PoC Dork: N/A Date: 2019-01-11 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.pixarra.com/ Software Link: http://www.pixarra.com/uploads/9/4/6/3/94635436/tbpaintstudioinstall.exe Version: 2.17 Category: Dos Tested on:...