Open Source Vulnerabilities

zoneminder

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition

webkit2gtk

logic issue was addressed with improved restrictions

jbig2dec

jbig2_image_compose in jbig2_image

zoneminder

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1

librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 82

webkit2gtk

memory corruption issue was addressed with improved validation

zoneminder

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1

webkit2gtk

logic issue was addressed with improved restrictions

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78

podofo

PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor

zoneminder

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1

webkit2gtk

bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2

librewolf, librewolf, librewolf, librewolf, librewolf

When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elements other than those that it injected into the page

podofo

PoDoFo::PdfVariant::DelayedLoad function in PdfVariant

zoneminder

stored-self XSS exists in web/skins/classic/views/controlcaps

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

podofo

GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack

webkit2gtk

logic issue was addressed with improved state management

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak

zoneminder

classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user

log4cxx

SQL injection in Log4cxx when using the ODBC appender to send log messages to a database

xbps

In FreeBSD 12

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

podofo

PoDoFo::PdfColor::operator function in PdfColor

webkit2gtk

access issue existed in Content Security Policy

zoneminder

stored-self XSS exists in web/skins/classic/views/zones

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

podofo

Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser

webkit2gtk

use after free issue was addressed with improved memory management

zoneminder

issue was discovered in ZoneMinder v1

librewolf, librewolf, librewolf, librewolf, librewolf

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

podofo

Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant

webkit2gtk

out-of-bounds read was addressed with improved input validation

librewolf, librewolf, librewolf, librewolf, librewolf

Repeated calls to the history and location interfaces could have been used to hang the browser

zoneminder

ZoneMinder v1

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

webkit2gtk

use after free issue was addressed with improved memory management

podofo

stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt

librewolf, librewolf, librewolf, librewolf, librewolf

Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated

zoneminder

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1

otrs

In Open Ticket Request System (OTRS) 3

pev

Buffer Overflow vulnerabilityexists in Pev 0

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

webkit2gtk

command injection issue existed in Web Inspector

podofo

Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant

perl-cryptx

In LibTomCrypt through 1

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver