Mozilla: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RLSA-2021:5013 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.4.0 ESR. Security Fixes: Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 Mozilla: URL leakage when navigating while...

RHEL 7 : firefox (RHSA-2021:5014)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:5014 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

[SECURITY] Fedora 34 Update: dmtx-utils-0.7.6-9.fc34.1

libdmtx is open source software for reading and writing Data Matrix 2D bar-codes on Linux, Unix, OS X, Windows, and mobile devices. At its core libdmtx is a shared library, allowing C/C++ programs to use its capabilities without restrictions or overhead. The included utility programs, dmtxread an...

CVE-2021-44518

An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation lock or unlock activated via the companion app. The code is sent unencrypted, allowing any attacker with the same app either Android or iOS to add th...

eGeeTouch 3rd Generation Travel Padlock application 安全漏洞

The eGeeTouch 3rd Generation Travel Padlock application is a smart luggage lock from eGeeTouch, Inc. that provides simple and enhanced security for travel luggage to meet the travel experience of a growing number of travelers across the globe. A security vulnerability exists in the eGeeTouch 3rd...

CVE-2021-24853

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects...

[SECURITY] Fedora 35 Update: dmtx-utils-0.7.6-9.fc35.1

libdmtx is open source software for reading and writing Data Matrix 2D bar-codes on Linux, Unix, OS X, Windows, and mobile devices. At its core libdmtx is a shared library, allowing C/C++ programs to use its capabilities without restrictions or overhead. The included utility programs, dmtxread an...

GHSA-WX8Q-RGFR-CF6V Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server

Impact Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID. Patches v1.1.2+ Workarounds There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can on...

Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server

Impact Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID. Patches v1.1.2+ Workarounds There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can on...

Robinhood Trading Platform Data Breach Hits 7M Customers

Investor trading app company Robinhood Markets has confirmed a data breach that affects the personal information of about 7 million customers – roughly a third of its user base. A cyberattacker made off with emails and more, which could lead to follow-on attacks for Robinhood customers. The tradi...

CVE-2021-1115

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for private IOCTLs, where an attacker with local unprivileged system access may cause a NULL pointer dereference, which may lead to denial of service in a component beyond the vulnerable...

SUSE-SU-2021:3520-1 Security update for open-lldp

This update for open-lldp fixes the following issues: - CVE-2018-10932: Fixed an improper sanitization of shell-escape codes. bsc1104624...

CVE-2021-41177

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits as as AnonRateThrottle or UserRateThrottle was thus not rat...

CVE-2021-38451

The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those function codes, the user must supply parameters. There is no sanitation on the value of the offset, which allows the client to specify any offset and read out-of-bounds data...

CVE-2021-38477

There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the manipulation and/or the deletion of files...

CVE-2021-38451

The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those function codes, the user must supply parameters. There is no sanitation on the value of the offset, which allows the client to specify any offset and read out-of-bounds data...

Out-of-bounds

The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those function codes, the user must supply parameters. There is no sanitation on the value of the offset, which allows the client to specify any offset and read out-of-bounds data...