Open Source Vulnerabilities

zoneminder

file disclosure and inclusion vulnerability exists in web/views/file

otrs

Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i

podofo

issue was discovered in PoDoFo 0

rizin

Rizin is a UNIX-like reverse engineering framework and command-line toolset

webkit2gtk

use after free issue was addressed with improved memory management

zoneminder

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash

otrs

When an agent user is renamed or set to invalid the session belonging to the user is keept active

podofo

issue was discovered in PoDoFo 0

webkit2gtk

logic issue was addressed with improved restrictions

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash

otrs

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys

webkit2gtk

input validation issue was addressed with improved input validation

podofo

issue was discovered in PoDoFo 0

otrs

attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, passwo...

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker

libtommath

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS)

webkit2gtk

memory initialization issue was addressed with improved memory handling

podofo

In PoDoFo 0

otrs

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords

libtirpc

In libtirpc before 1

librewolf, librewolf, librewolf, librewolf, librewolf

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization

webkit2gtk

memory corruption issue was addressed with improved state management

podofo

In PoDoFo 0

otrs

Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript)

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS

webkit2gtk

use after free issue was addressed with improved memory management

podofo

In PoDoFo 0

otrs

Support bundle generated files could contain sensitive information that might be unwanted to be disclosed

librewolf, librewolf, librewolf, librewolf, librewolf

When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the origin...

fuse, fuse3

In fuse before versions 2

webkit2gtk

type confusion issue was addressed with improved memory handling

podofo

In PoDoFo 0

libcue

libcue provides an API for parsing and extracting data from CUE sheets

otrs

In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue

librewolf, librewolf, librewolf, librewolf, librewolf

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

postfixadmin

AliasHandler component in PostfixAdmin before 3

webkit2gtk

exploitable use-after-free vulnerability exists in WebKitGTK browser version 2

podofo

In PoDoFo 0

otrs

Agent A is able to save a draft (i

spamassassin

Apache SpamAssassin 3

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user

webkit2gtk

code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2

podofo

In PoDoFo 0

otrs

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered ...

spamassassin

potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3

librewolf, librewolf, librewolf, librewolf, librewolf

Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors

webkit2gtk

out-of-bounds write issue was addressed with improved bounds checking

podofo

PoDoFo 0

otrs

improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound