CVE-2021-33879

Tencent GameLoop before 4.1.21.90 downloads updates over HTTP, enabling MITM tampering of the update package XML. An attacker could replace the download URL with a path to an arbitrary Windows executable; the only integrity check is an MD5 comparison with the XML, allowing the executable to run o...

CVE-2021-33879

Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only...

Tencent GameLoop 安全漏洞

Tencent GameLoop is an Android emulator from Tencent, a Chinese company. It enables players to play Android games on their computers. Tencent GameLoop before 4.1.21.90 suffers from a security vulnerability that originates from a malicious attacker in the MITM position that can be exploited to spo...

XStream is vulnerable to a Remote Command Execution attack

Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required...

Tencent Video (Windows client) suffers from a local power lifting vulnerability (CNVD-2021-37954)

Tencent Video, an online video platform with popular content and professional media operation capabilities, is a comprehensive video content platform that aggregates hit movies and TV shows, variety shows and entertainment, sports events, news and information. Tencent Video Windows client suffers...

Tencent QQ PC version suffers from a local power lifting vulnerability

Tencent QQ is a chat software. Tencent QQ PC version suffers from a local privilege extraction vulnerability, which can be exploited by attackers to obtain administrator privileges and execute malicious code...

Tencent OS-tiny 输入验证错误漏洞

Tencent OS-tiny is a real-time operating system developed by Tencent for the Internet of Things IoT. It is characterized by low power consumption, low resource consumption, modularity, security and reliability, which can effectively improve the development efficiency of IoT terminal products. An...

CVE-2021-27247

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop version. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Design/Logic Flaw

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop version. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2021-27247

CVE-2021-27247 affects Tencent WeChat 2.9.5 desktop. The flaw is in the WXAM decoder where unvalidated user data allows an out-of-bounds read, exposing sensitive information. This may enable arbitrary code execution when combined with other vulnerabilities, with user interaction required (malicio...

CVE-2021-27247

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat 2.9.5 desktop version. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Tencent video windows client has denial of service vulnerability

Tencent Video, launched in April 2011, is an online video platform with popular content and professional media operation capabilities. It is a comprehensive video content platform that aggregates hot movies and TV shows, variety shows and entertainment, sports events, news and information, etc.,...

Denial of Service Vulnerability in Pothole App

Tencent Wave Cave app is a comic book reading platform that gathers a large number of users who love the second generation. A denial-of-service vulnerability exists in Wave Cave App, which can be exploited by attackers to cause denial-of-service attacks...

Janus Signature Vulnerability in App Store

Application Treasure is a mobile application acquisition platform created by Tencent Application Center for smartphone users. A Janus signature vulnerability exists in AppBao, which can be exploited by an attacker to gain control of the server...

GHSA-M33V-338H-4V9F Path traversal in Node-Red

Impact This vulnerability allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API. Patches The issue has been patched in Node-RED 1.2.8 Workarounds The vulnerability applies only...

Path traversal in Node-Red

Impact This vulnerability allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with projects.read permission is able to access any file via the Projects API. Patches The issue has been patched in Node-RED 1.2.8 Workarounds The vulnerability applies only...

Tencent WeChat WXAM Decoder Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tencent WeChat. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the WXAM...

Memory corruption vulnerability exists in QQ Video for Windows (CNVD-2021-17324)

QQ Video is a local player from Tencent that supports movie and music files in any format. A memory corruption vulnerability exists in QQ Video for Windows, which can be exploited by attackers to cause the program to crash...

Memory Corruption Vulnerability in QQ Video for Windows

QQ Video is a local player from Tencent that supports movie and music files in any format. A memory corruption vulnerability exists in QQ Video for Windows, which can be exploited by attackers to cause the program to crash...

Tencent's Blue Whale Intelligent Cloud suffers from unauthorized access vulnerability

Blue Whale Smart Cloud, or Blue Whale for short, is a sub-brand of Tencent Smart Camp, a division of Tencent's Game Operations Department. It is a set of PaaS-based technology solutions that provides a comprehensive front- and back-office development framework, scheduling engine, public component...