UBUNTU-CVE-2021-29952

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

CVE-2021-29952

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox 88.0.1 and Firefox for Android 88.1.3...

PT-2021-2883

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 88.0.1 Firefox for Android versions prior to 88.1.3 Description The issue is caused by synchronization errors when using shared resources in the Web Render components of the Firefox web browser. This could lead to...

Mozilla Firefox < 88.0.1

The version of Firefox installed on the remote Windows host is prior to 88.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-20 advisory. - When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume tha...

Security Vulnerabilities fixed in Firefox 88.0.1, Firefox for Android 88.1.3 — Mozilla

By triggering multiple pop-up prompts containing javascript: URLs, a malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability.Note: This issue only...

Google Android 代码问题漏洞

Google Android is a Linux-based open source operating system from the Google Open Handheld Consortium Google. A denial of service vulnerability exists in Google Android 11. The vulnerability is caused due to a denial of service due to a missing null check in the RenderStruct of...

gitea:fuzz_markdown_render_raw: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5726263340826624 Project: gitea Fuzzing Engine: libFuzzer Fuzz Target: fuzzmarkdownrenderraw Job Type: libfuzzerasangitea Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffffffffffffff Crash State: NULL Sanitizer: address ASAN...

Who has the fastest F1 website in 2021? Part 7

This is part 7 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10 recently-built/updated sites that have broadly the same goal, but are built by different teams, and have different performanc...

CVE-2020-36238

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check...

CVE-2020-36238

CVE-2020-36238 affects Jira Server/Data Center. The vulnerability exists in the /rest/api/1.0/render resource and allows remote anonymous attackers to determine whether a username is valid via a missing permissions check. Affected versions include Jira Server/Data Center before 8.5.13, from 8.6.0...

PT-2021-11975 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Jira Server and Data Center versions 8.5.12 and earlier Jira Server and Data Center versions 8.6.0 through 8.13.4 Jira Server and Data Center versions 8.14.0 through 8.15.0 Description: The issue allows remote anonymous attackers to determine...

CVE-2020-36238: Incorrect Authorization

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check...

Who has the fastest F1 website in 2021? Part 2

Ohhh, you've come back for more? Excellent. I was worried it was just going to be me sat here, typing to myself. This is part 2 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10...

CVE-2021-21383 XSS in Wiki.js

Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained...

CVE-2020-27282

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files...

The vulnerability of the image_render_color_thresh() function (base/gxicolor.c) in the software for processing, transforming, and generating Ghostscript documents allows a hacker to trigger a service failure.

The vulnerability of the imagerendercolorthresh function base/gxicolor.c in the software for processing, transforming, and generating Ghostscript documents is related to writing beyond buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2021-21310 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2021-21310 Source advisory: OSV:GHSA-PG53-56CG-4M8Q...

PT-2021-8107 · Htmldoc +3 · Htmldoc +3

Name of the Vulnerable Software and Affected Versions: HTMLDOC version 1.9.12 Description: The issue is related to a heap buffer overflow in the render table row function, located in the ps-pdf.cxx component of the HTMLDOC tool. This overflow can lead to arbitrary code execution and denial of...

PT-2021-27598

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the following functions: fz adjust ft glyph width, do ft...

PT-2021-11866

Name of the Vulnerable Software and Affected Versions: Newsletter plugin versions prior to 6.8.2 for WordPress Description: The issue allows authenticated remote attackers with minimal privileges to inject arbitrary PHP objects via the optionsinline edits parameter using the "tpnc render" AJAX...