Ricardo Silva

The issue concerns the exposure of sensitive information in the CTT Expresso para WooCommerce plugin for WordPress. This exposure occurs via the /wp-content/uploads/cepw directory, where generated .pdf and log files are publicly accessible. These files contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses.

There is an integer overflow vulnerability in RedisBloom, a module used in Redis. This vulnerability allows an attacker, who is a Redis client with knowledge of the password, to allocate memory in the heap that is lesser than the required memory due to wraparound. As a result, read and write operations can be performed beyond the allocated memory, leading to information leaks and out-of-bounds writes. The integer overflow is located in the `CMS.INITBYDIM` command, which initializes a Count-Min Sketch to dimensions specified by the user. It accepts two values, `width` and `depth`, and uses them to allocate memory in `NewCMSketch()`.

The issue is related to the mishandling of arrays in Janet.

The issue is related to a stack-based buffer overflow in the ZoomLauncher binary, which can be exploited by remote attackers to execute arbitrary code. This is achieved by leveraging the `zoommtg://` scheme handler.

The issue concerns the ZoomLauncher binary in the Zoom client for Linux, which does not properly sanitize user input when constructing a shell command. This allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.