Neowsy

A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. Upgrading to version 3.9.3 is able to resolve this issue. The name of the patch is a2c755c8dc9ad0eb7d5fd261b09aff90f649433c. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to version 1.8.34-beta is sufficient to resolve this issue. This patch is called ccba99b66bc61acf46e4a332034799d7452ddea6. Upgrading the affected component is advised.

A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. Upgrading to version 1.10.2 is sufficient to fix this issue. The name of the patch is 3d48df7cce05e39fa4de1e42768492307f26882e. The affected component should be upgraded.

A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The name of the patch is 64c0155abb88e714198241d41b918cefc0d5a42a. It is advisable to implement a patch to correct this issue.

**Name of the Vulnerable Software and Affected Versions** sanjevirau gsubs versions prior to 1.0.4 **Description** A remote code injection flaw exists within the Electron component in the `renderer/index.js` file. The issue occurs in the `showQuerySuccessPage()` function when the `filename` argument is manipulated, allowing an attacker to execute arbitrary code remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `showQuerySuccessPage()` function to minimize the risk of exploitation.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** نظام إدارة الرواتب من code-projects، الإصدار 1.0 **الوصف** تم اكتشاف ثغرة خطيرة في النظام تؤثر على ملف update account.php. تؤدي معالجة المعلمة `deduction` إلى حدوث حقن SQL. يمكن استغلال هذه الثغرة عن بُعد. **التوصيات** بالنسبة لنظام إدارة الرواتب من code-projects الإصدار 1.0، يُنصح بتقييد الوصول إلى الملف `update account.php` حتى يتوفر تصحيح. كحل مؤقت، تجنب استخدام المعلمة `deduction` في الملف المتأثر لتقليل مخاطر الاستغلال. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.