Use after free in lru crate

Lru crate has use after free vulnerability. Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop, will remove and free the value, and but it's still possible to access the reference of value which is already...

PT-2021-24294

Name of the Vulnerable Software and Affected Versions: lru crate versions prior to 0.7.1 Description: The issue is related to a use-after-free problem in the iterators of the lru crate. This occurs when specific functions, such as pop, are called, which remove and free the value, but it is still...

wasm3:fuzzer: Index-out-of-bounds in Pop

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=6471071226789888 Project: wasm3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzer Job Type: libfuzzerubsanwasm3 Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: Pop...

CVE-2021-44201

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

Cross site scripting

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

CVE-2021-44201 Cross-site scripting (XSS) was possible in notification pop-ups

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

CVE-2021-44201

CVE-2021-44201 affects Acronis Cyber Protect 15 (Windows, Linux) before build 28035. The vulnerability is a cross-site scripting (XSS) in notification pop-ups caused by failing to validate user input data, enabling potential client-side code execution. Per the connected records, the issue is netw...

CVE-2021-44201: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 28035...

PT-2021-24062

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 versions prior to build 28035 Description: A cross-site scripting XSS issue was possible in notification pop-ups. This allowed for potential malicious script execution. The estimated number of potentially affected...

Cross-site scripting (XSS) was possible in notification pop-ups

...

ALBA-2021:4533 ibus bug fix update

The Intelligent Input Bus IBus is an input method framework for multilingual input in Unix-like operating systems. Bug fix: Previously, in GNOME Wayland desktop in AlmaLinux 8.5, the IBus emoji candidate pop-up was used with IBus UI and the selected candidate could not inserted into the target...

ibus bug fix update

An update is available for ibus. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Intelligent Input Bus IBus is an input method framework for multilingual inp...

pop-in.ch Improper Access Control vulnerability OBB-2251318

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2021-1386

Name of the Vulnerable Software and Affected Versions: IBus affected versions not specified Description: The issue concerns the Intelligent Input Bus IBus, an input method framework for multilingual input in Unix-like operating systems. A problem was identified where the IBus emoji candidate...

Free Discord Nitro Offer Used to Steal Steam Credentials

There’s a new scam making the rounds on Discord, through which cybercriminals can harvest Steam account information and make off with any value it contains. Gamer-aimed Discord scams are just about everywhere. But researchers flagged a new approach as noteworthy because it crosses over between...

WordPress Media-Tags 3.2.0.2 Plugin - Stored Cross-Site Scripting Vulnerability

Exploit Title: WordPress Plugin Media-Tags 3.2.0.2 - Stored Cross-Site Scripting XSS Exploit Author: Akash Rajendra Patil Vendor Homepage: https://wordpress.org/plugins/media-tags/ Software Link: www.codehooligans.com/projects/wordpress/media-tags/ Version: 3.2.0.2 Tested on Windows How to...

Ad-blocker Chrome extension AllBlock injected ads in Google searches

By Deeba Ahmed AllBlock was available on Google Chrome's Web Store where it is marketed as a potent Ad Blocker focusing on Facebook and YouTube to prevent pop-ups. This is a post from HackRead.com Read the original post: Ad-blocker Chrome extension AllBlock injected ads in Google searches...

rust-crossbeam-deque: race condition may lead to double free

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never...

F-Secure Internet Gatekeeper Denial of Service Vulnerability

F-Secure Internet Gatekeeper is a gateway product that acts as a virus scanning agent for HTTP, SMTP, POP, and FTP protocols. a denial of service vulnerability exists in the web user interface of F-Secure Internet Gatekeeper version 5 Series. An attacker could exploit the vulnerability by sending...

in dompdf/dompdf

Description DomPDF is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the filegetcontents function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate...