CVE-2021-28594

The CVE-2021-28594 entry concerns Adobe Creative Cloud Desktop Application installer (2.4 and earlier). The vulnerability is an Uncontrolled Search Path Element in the installer, allowing arbitrary code execution in the current user context. Exploitation requires user interaction (victim opens a ...

CVE-2021-28594: Uncontrolled Search Path Element

Adobe Creative Cloud Desktop Application installer version 2.4 and earlier is affected by an Uncontrolled Search Path Element vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this...

GHSA-HWVQ-6GJX-J797 Special Element Injection in notebook

Impact Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook. Patches 5.7.11, 6.4.1 References OWASP Page on Injection Prevention For more information If you have any questions or comments about this advisory, or vulnerabilities ...

Matrix clients -- several vulnerabilities

Matrix developers report: Today we are disclosing a critical security issue affecting multiple Matrix clients and libraries including Element Web/Desktop/Android, FluffyChat, Nheko, Cinny, and SchildiChat. Specifically, in certain circumstances it may be possible to trick vulnerable clients into...

CVE-2021-28636

CVE-2021-28636 is an Uncontrolled Search Path Element vulnerability in Adobe Acrobat Reader DC. Affected products include Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier), and 2017.011.30197 (and earlier). The underlying issue is an unsafely chosen search path...

CVE-2021-28595

Adobe Dimension 3.4 and earlier are affected by an Uncontrolled Search Path Element vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file). The issue is addressed in APSB21-40 with a patch likel...

CVE-2021-28595: Uncontrolled Search Path Element

Adobe Dimension version 3.4 and earlier is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a...

OSV-2021-1143 UNKNOWN WRITE in QtPrivate::QPodArrayOps<QPainterPath::Element>::copyAppend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37306 This is the same issue as OSV-2021-1121 which it replaced after that one was closed wrongly. Crash type: UNKNOWN WRITE Crash state: QtPrivate::QPodArrayOps::copyAppend QtPrivate::QCommonArrayOps::growAppend QList::append...

PT-2021-27710

Name of the Vulnerable Software and Affected Versions: Qt affected versions not specified Description: The issue is related to a crash caused by an unknown write operation. Technical details about the crash include the involvement of QtPrivate::QPodArrayOps::copyAppend,...

qt:qtsvg_svg_qsvgrenderer_render: Crash in QtPrivate::QPodArrayOps<QPainterPath::Element>::copyAppend

Project: git://code.qt.io/qt/qt5.git Detailed Report: https://oss-fuzz.com/testcase?key=5387021181911040 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtsvgsvgqsvgrendererrender Job Type: libfuzzerasani386qt Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x0fffed80 Crash State:...

Mozilla: Memory corruption as a result of incorrect style treatment

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.13, and Firefox 91...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in devcode-it/openstamanager

✍️ Description A user without access to the software can inject a portion of HTML code in access logs. 🕵️‍♂️ Proof of Concept Simulate login with a crafter Client-IP header like this: curl -H 'Client-IP: INJECT' -d 'username=&password=&op=login' 'http://localhost//?op=login' The result is: 💥 Impact...

PaperCut MF/NG Scripting

The vulnerability of the printing control software in PaperCut MF and PaperCut NG exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor, operating remotely, to implement a malicious script through the user interface...

PYSEC-2021-760

TensorFlow is an end-to-end open source platform for machine learning. The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference. The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressin...

PYSEC-2021-259

TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to tf.rawops.CompressElement. The implementation was accessing the size of a buffer obtained from the return of a separate function...

PYSEC-2021-748

TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to tf.rawops.CompressElement. The implementation was accessing the size of a buffer obtained from the return of a separate function...

PYSEC-2021-562

TensorFlow is an end-to-end open source platform for machine learning. The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference. The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressin...

PYSEC-2021-760

TensorFlow is an end-to-end open source platform for machine learning. The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference. The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressin...

CVE-2021-37649

TensorFlow is an end-to-end open source platform for machine learning. The code for tf.rawops.UncompressElement can be made to trigger a null pointer dereference. The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressin...

CVE-2021-37637

TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by passing an invalid input to tf.rawops.CompressElement. The implementation was accessing the size of a buffer obtained from the return of a separate function...