226 matches found
Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario
The Mozilla Foundation Security Advisory describes this flaw as: When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow...
Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario
The Mozilla Foundation Security Advisory describes this flaw as: When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow...
CVE-2020-24582
Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface...
Cross site scripting
Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface...
Hello open source security! Managing risk with software composition analysis
When first learning to code many people start with a rudimentary “Hello World” program. Building the program teaches developers the basics of a language as they write the code required to display “Hello World” on a screen. As developers get more skilled, the complexity of the programs they build...
Design/Logic Flaw
ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges member is able to upload this. It is possible to bypass the MIME type check and file-extension check...
June 9, 2020—KB4561649 (OS Build 10240.18608)
None None...
June 9, 2020—KB4561621 (OS Build 17134.1550)
None None...
WhiteSource Software Application Vulnerability Management Injection Vulnerability
WhiteSource Software Application Vulnerability Management AVM is a suite of application vulnerability management platforms from WhiteSource Software. The platform is mainly used to view and synchronize the review of its static application security test results SAST, dynamic application security...
May 12, 2020—KB4556846 (Monthly Rollup)
None None...
Unspecified Vulnerability in Apple iOS and iPadOS Messages Composition Component
Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple iPadOS is an operating system for iPad tablets. messages Composition is one of the message editing components. A security vulnerability exists in the Messages Compositio...
UPDATE: OWASP Dependency-Check 5.3.0
My first post about this open source OWASP project was about an older version. A while ago, a new version - OWASP Dependency-Check 5.3.0 was released. This post discusses the changes made to the open source software composition analysis utility in the latest release that includes a lot of bug fix...
Microsoft Windows Multiple Vulnerabilities (KB4534310)
This host is missing a critical security update according to Microsoft KB4534310 Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...
January 14, 2020—KB4534303 (Monthly Rollup)
None None...
December 10, 2019—KB4530698 (Security-only update)
None None...
September 10, 2019—KB4516033 (Security-only update)
None None...
September 10, 2019—KB4516051 (Security-only update)
None None...
uriparser: Integer overflow via uriComposeQuery* or uriComposeQueryEx* function
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery or uriComposeQueryEx function because of an unchecked multiplication...
CVE-2019-13303
A heap-based buffer over-read was discovered in ImageMagick in the way it composes images. Applications compiled against ImageMagick libraries that accept untrustworthy images may be vulnerable to this flaw. An attacker could abuse this flaw by providing a specially crafted image to make the...
Bug in Anesthesia Respirators Allows Cyber-Tampering
A vulnerability in GE Healthcare’s Aestiva and Aespire anesthesia devices would allow an unauthenticated cybercriminal on the same network as the device to modify gas composition parameters within the devices’ respirator function, thus changing sensor readings for gas density. According to GE...