Ucha Gobejishvili

The issue is related to errors in resource management in the Intel video driver used by Firefox. It allows remote attackers to cause a denial of service, which can result in memory consumption or stack memory corruption, by triggering the use of a WebGL shader.

An information disclosure issue exists when Microsoft XML Core Services exposes memory addresses not intended for public disclosure. This could allow an attacker to bypass Address Space Layout Randomization (ASLR) and potentially read private data. The issue does not allow an attacker to execute code or elevate user rights directly but could be used to obtain information to further compromise the affected system.

The issue is related to a use-after-free vulnerability in the CanvasRenderingContext2D implementation, allowing remote attackers to execute arbitrary code. This is achieved by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element. The vulnerability can be exploited by a remote attacker to execute arbitrary code.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of admins for specific requests, including adding group plans via "admin/group plans.html" and adding extra packages via "admin/extra packs/create extra pack.html".

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved via the `createrule` parameter to "dnat.cgi", the `addrule` parameter to "dansguardian.cgi", or the `PATH INFO` to "openvpn users.cgi".

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.

The issue allows remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the `file` parameter to "document.php" or `backtopage` parameter in a create action to "comm/action/fiche.php".