Andrew Krasichkov

An issue was discovered that allows an attacker to craft a malicious .docx file and exploit the `NSFileDownloader` function. This exploitation enables the attacker to pass parameters to a binary, such as `curl` or `wget`, and remotely execute code on a victim's server.

An issue was discovered that allows an attacker to craft a malicious .docx file and exploit the unzip function. This can lead to rewriting a binary and remotely executing code on a victim's server.

An issue was discovered that allows an attacker to craft a malicious .docx file and exploit XML injection. This can lead to entering an attacker-controlled parameter into the x2t binary, potentially allowing the attacker to rewrite the binary and/or libxcb.so.1, and execute code on a victim's server.

A vulnerability was found in libpq, the default PostgreSQL client library, where it failed to properly reset its internal state between connections. If an affected version of libpq was used with `host` or `hostaddr` connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections, or potentially cause other impact through SQL injection by causing the `PQescape()` function to malfunction.

Name of the Vulnerable Software and Affected Versions: sanitize-html versions 1.11.1 and below Description: The issue concerns a cross-site scripting (XSS) vulnerability in certain scenarios. When at least one non-text tag is allowed, the result is a potential XSS vulnerability. This occurs when the `allowedTags` parameter includes at least one `nonTextTag`. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Recommendations: For versions 1.11.1 and below, update to version 1.11.4 or later. As a temporary workaround, consider restricting the use of the `allowedTags` parameter to exclude `nonTextTags` until a patch is available. Avoid using the `allowedTags` parameter with `nonTextTags` in the affected API endpoint until the issue is resolved.

The issue is related to the COM.MICROSOFT.WEBSERVICE function in LibreOffice, which allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document. This is due to inadequate management of registration data. An attacker can exploit this issue by sending a specially crafted request to gain access to protected information.

The issue involves event handlers on "marquee" elements being executed despite a strict Content Security Policy (CSP) that disallows inline JavaScript.