Nextcloud: Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process

A code injection vulnerability was discovered in Nextcloud Desktop Client version 33.0.5 for macOS. The vulnerability combined two weaknesses: the QtWebEngineProcess binary was shipped with library validation disabled, and it contained dead build-server paths in its rpath that were searched befor...

CVE-2019-12171

Summary : CVE-2019-12171 affects the Dropbox desktop application (version 71.4.108.0) where Dropbox.exe and QtWebEngineProcess.exe store credentials in cleartext in memory after login or account creation, and these credentials are not securely freed in the running process. This is corroborated by...