Привет! Я Элис, редактор интерфейсов в СберМаркете. Мой домен создаёт приложения для курьеров и админки для сотрудников компании. С текстами разных форматов работаю 8 лет, 3 из которых я в UX. Помогаю бизнесу и пользователям находить общий язык, могу объяснить «в чём сила» даже бабушке.Сегодня хочу рассказать, как гайды, глоссарии и редполитика помогут навести порядок в продукте и повысить лояльность пользователей. Читать далее
На прошлой неделе мой подписчик по имени Федя успешно снялся с воинского учета, не покидая Казахстан. В этой статье мы подробно разберем его пример, а также вместе с юристом распишем вам детальный пошаговый гайд для всего процесса. Читать далее
AVideo is an open-source video platform. Prior to version 12.4, AVideo is vulnerable to remote code execution when an attacker embeds a malicious video link. This issue is fixed in version 12.4.
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.
VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall.  The patch that added the support for the…
Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0, installations that include apptainer-suid < 1.1.8, and all versions of Singularity in their default configurations on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload. No cross-site scripting attack is possible due to the hardcoded content security policy. Version 3.71.0 of the SDK patches over the issue. As a workaround, restarting the client…
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens