Fabian Bräunlein

The issue is related to incorrect code generation management in Microsoft Office. It allows a remote attacker to execute arbitrary code.

The issue allows a remote unauthenticated attacker to potentially exploit a DOM-based cross-site scripting vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the DOM environment in the browser. This malicious code is then executed by the web browser in the context of the vulnerable web application.

The issue is related to the handling of non-http(s) hyperlinks in Apache OpenOffice, which can lead to untrusted code execution if a link is specifically crafted. This problem has existed since about 2006. It is recommended to be careful when opening documents from unknown and unverified sources.

The issue is related to resource injection due to missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.

Name of the Vulnerable Software and Affected Versions: KDE Discover versions prior to 5.21.3 KDE Discover versions prior to 5.18.7 Description: The issue arises from the automatic creation of links to potentially dangerous URLs based on the content of the store.kde.org web site. These URLs are neither https:// nor http://. Recommendations: For versions prior to 5.21.3, update to version 5.21.3 or later. For versions prior to 5.18.7, update to version 5.18.7 or later.

The issue allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. This is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.