Yoko Kho

يسمح التعبير النمطي المستخدم للتحقق من صحة مدخلات المضيف ونصوص إجراءات الأحداث بتجاوز عملية التحقق عند تمكين الوضع متعدد الأسطر. وعلى وجه التحديد، يمكن التحايل على استخدام علامات التثبيت (`^` و`$`) في عملية التحقق من صحة المدخلات التي يحددها المسؤول عن طريق إدخال حرف سطر جديد. وهذا يسمح للمستخدمين المصادق عليهم بإدخال أوامر شل وتنفيذها.

The issue was addressed with improved UI. Visiting a malicious website may lead to address bar spoofing.

The issue is related to a misconfiguration in the Node.js environment settings of WD Discovery, which could allow code execution by utilizing the `ELECTRON RUN AS NODE` environment variable. Any malicious application operating with standard user permissions can exploit this, enabling code execution within the WD Discovery application's context. The attack vector requires the victim to have the WD Discovery app installed on their device.

The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability. This allows an adversary with local access to execute code under the context of the AuthPoint Password Manager application.

The issue is related to errors in handling files, specifically cookies, which can allow a remote attacker to gain unauthorized access to protected information.

The issue allows an attacker to execute code via the `DYLIB INSERT LIBRARIES` environment variable. This is a code injection problem in Remote Desktop Manager on macOS.

The issue is related to an inconsistent user interface that allows an attacker to obfuscate the address bar, potentially leading to address bar spoofing.

An inconsistent user interface issue was addressed with improved state management. Visiting a malicious website may lead to address bar spoofing.

A malicious application running with standard user permissions could potentially execute code in the WD Discovery application's process through library injection by using DYLD environment variables.

The issue concerns content spoofing in the dav app, where the exception message displayed on the DAV endpoints, such as "/api/dav", contained partially user-controllable input. This could lead to a potential misrepresentation of information.

The issue is related to an untrusted search path vulnerability in the installer. This vulnerability can be exploited by a local user to gain privileges via a Trojan horse DLL in the current working directory.