The vulnerability of applications for creating screenshot copies using Snipping Tool and Snip and Sketch on Windows operating systems allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of applications for creating screenshot copies using Snipping Tool and Snip and Sketch on Microsoft Windows operating systems is related to an improper file saving procedure after editing and replacing the original file. Exploiting this vulnerability can allow an attacker to gai...

Microsoft Issues Patch for aCropalypse Privacy Flaw in Windows Screenshot Tools

Microsoft has released an out-of-band update to address a privacy-defeating flaw in its screenshot editing tool for Windows 10 and Windows 11. The issue, dubbed aCropalypse, could enable malicious actors to recover edited portions of screenshots, potentially revealing sensitive information that m...

KLA48687 OSI vulnerability in Microsoft Apps

An information disclosure vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2023-28303 Related products Microsoft-Windows Microsoft-Windows-10 CVE list CVE-2023-28303 warning KB list Solution Update...

PT-2023-1976

Name of the Vulnerable Software and Affected Versions Windows Snipping Tool versions prior to 10.2008.3001.0 Windows 10 Snip & Sketch versions prior to 11.2302.20.0 Description The issue is related to the incorrect procedure of saving a file after editing and replacing it with its original file,...

svg-sketch-pdf (>=1.0.12, <=1.0.28) potentially affected by CVE-2018-25061 via rgb2hex (0.1.0)

rgb2hex NPM version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on rgb2hex and may be impacted: - svg-sketch-pdf =1.0.12, =1.0.28 Source cves: CVE-2018-25061 Source advisory: OSV:GHSA-7599-FQGM-V84P...

Malicious code in sketch-pexels (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60d8fa01b1b525ddb0376773fc65eb3e5cdf06f8499d469a7eaba8739b5e3b40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6148 Malicious code in sketch-pexels (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60d8fa01b1b525ddb0376773fc65eb3e5cdf06f8499d469a7eaba8739b5e3b40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

June 28, 2022—KB5014666 (OS Builds 19042.1806, 19043.1806, and 19044.1806) Preview

None None...

MAL-2022-6147 Malicious code in sketch-multi-lingual-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dc963980cef03ca59ff4df6236056bfe2d4a7bb38df9f9c2aed51bc8869a0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sketch-multi-lingual-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dc963980cef03ca59ff4df6236056bfe2d4a7bb38df9f9c2aed51bc8869a0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1160 Malicious code in atlassian-sketch-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 127fce48a3621d82c27eb14ee5dfa2aa7084e2b7c2cff9fe775be9063948f9eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in atlassian-sketch-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 127fce48a3621d82c27eb14ee5dfa2aa7084e2b7c2cff9fe775be9063948f9eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jira-cloud-for-sketch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ad48f9eea0ecfefd93ce7705dbe71a99132b23d8479beb15c59d17634ee94c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Unrestricted Upload of File with Dangerous Type in Sketch

CVE-2021-40531 !Exploit Demohttps://jonpalmisc.com/assets/...

CVE-2021-40531

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app...

CVE-2021-40531

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app...

Remote code execution

Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened, without the com.apple.quarantine extended attribute. This results in remote code execution, as demonstrated by CommandString in a terminal profile to Terminal.app...

CVE-2021-40531

CVE-2021-40531 affects Sketch (macOS). The vulnerability arises when Sketch 75 or earlier allows library feeds to bypass the com.apple.quarantine attribute, causing files to be downloaded and opened automatically. This quarantine bypass can lead to remote code execution, as demonstrated by embedd...

Sketch 代码问题漏洞

Sketch is a vector graphics editor for macOS from the Dutch company Sketch. Its main use is for user interface and user experience design for websites and mobile applications, Sketch has features for prototyping and collaboration. Sketch suffers from a security vulnerability that stems from...

@36node/sketch-cli (>=0.1.3, <=0.3.2), @adobe/commerce-cif-commercetools-cart (>=1.0.1, <=1.0.2) +324 more potentially affected by CVE-2021-37713 via tar (>=4.0.1, <=4.4.15)

tar NPM version =4.0.1, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2021-37713 Source advisory: OSV:GHSA-5955-9WPR-37JH...