MAL-2023-1515 Malicious code in crcloud-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2872c6473427534afbbcbe64c7af6c4d0ec7259992ce2122f13e14a6e6f20c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in crcloud-layout

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

libredwg:llvmfuzz: Heap-buffer-overflow in bit_TV_to_utf8_codepage

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4855530647322624 Project: libredwg Fuzzing Engine: libFuzzer Fuzz Target: llvmfuzz Job Type: libfuzzerasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

OPENSUSE-SU-2023:0230-1 Security update for opensuse-welcome

This update for opensuse-welcome fixes the following issues: - CVE-2023-32184: Fixed possible security issues when using the feature to change the Xfce desktop layout, caused by a fixed temporary file path used in /tmp/layout boo1213708...

Security update for opensuse-welcome (moderate)

openSUSE Security Update: Security update for opensuse-welcome Announcement ID: openSUSE-SU-2023:0230-1 Rating: moderate References: 1213708 Cross-References: CVE-2023-32184 Affected Products: openSUSE Backports SLE-15-SP4 An update that fixes one vulnerability is now available. Description: This...

Advisory ROSA-SA-2023-2217

Software: libmicrohttpd 0.9.76 OS: ROSA-CHROME packageevrstring: libmicrohttpd-0.9.76-1.src.rpm CVE-ID: CVE-2023-27371 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: GNU libmicrohttpd before version 0.9.76 allowed remote DoS denial of service due to improper multipart/form-data boundary parsing in the...

SUSE CVE-2023-32184

A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a...

PT-2023-5399 · Unknown +1 · Opensuse-Welcome +1

Name of the Vulnerable Software and Affected Versions: opensuse-welcome versions 0.1 through 0.1.9+git.35.4b9444a Description: A local attacker can execute code as the user that runs opensuse-welcome if a custom layout is chosen, due to an Insecure Storage of Sensitive Information vulnerability...

Google Chrome XML Bypass ASLR

The vulnerability of the Google Chrome XML browser component is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass the ASLR protection mechanism by using a specially created HTML page...

CVE-2023-38239

Adobe Acrobat Reader versions 23.003.20244 and earlier and 20.005.30467 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue...

CVE-2023-38235

Adobe Acrobat Reader versions 23.003.20244 and earlier and 20.005.30467 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue...

CVE-2023-38238

Adobe Acrobat Reader versions 23.003.20244 and earlier and 20.005.30467 and earlier are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requir...

n00b’s guide to DEF CON. Surviving the Matrix of the underground

Ah, DEF CON. The worlds largest hacker convention. A beacon for the diverse spectrum of cyber security enthusiasts. From code-cracking challenges to the infamous Wall of Sheep, the event is a hive of activities and opportunities. But before we dive into the world of hackerdom, lets get one thing...

Adobe InDesign Buffer Overflow Info Disclosure

The vulnerability of Adobe InDesign’s computer layout automation tool is related to reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Adobe InDesign Buffer Overflow Info Disclosure

The vulnerability of Adobe InDesign’s computer layout automation tool is related to reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

FollowNFT storage collision

Lines of code Vulnerability details Impact The lastFollowTokenId of FollowNFT contract has a storage collision. V2.0 storage layout: | lastFollowTokenId | uint128 | 17 | 0 | 16 | contracts/FollowNFT.sol:FollowNFT | | followerCount | uint128 | 17 | 16 | 16 | contracts/FollowNFT.sol:FollowNFT |...

Adobe InDesign Buffer Overflow Info Disclosure

The vulnerability of Adobe InDesign’s computer layout automation tool is related to reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Adobe InDesign Buffer Overflow Info Disclosure

The vulnerability of Adobe InDesign’s computer layout automation tool is related to reading data outside the buffer in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

QTextLayout DoS

The vulnerability of the QTextLayout component of the cross-platform software development framework for Qt is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially created SVG file...

GHSA-F9G6-FP84-FV92 impl `FromMdbValue` for bool is unsound

The implementation of FromMdbValue has several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of...