Febin Mon Saji

Foi identificada uma falha no MyASUS envolvendo o armazenamento inseguro de chaves sensíveis. Isso poderia potencialmente permitir que um ator não autorizado obtenha um token utilizado para comunicação com determinados serviços.

Uma vulnerabilidade de traversal de caminho no ZipCompressor do MyFiles permite que invasores locais gravem arquivos arbitrários. Este problema afeta o MyFiles no Android 11, Android 12 e uma versão específica no Android 13.

This issue allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBT files, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of the current user.

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks. The vulnerability is related to incorrect link resolution before accessing a file, which may enable an attacker to execute arbitrary commands.

The issue involves a directory traversal flaw in the parsing of EPUB and CBT files within Linux Mint Xreader. This allows remote attackers to potentially execute arbitrary code on affected systems. User interaction is required, specifically, the user must open a malicious EPUB or CBT file or visit a malicious page. The flaw stems from insufficient validation of user-supplied paths before they are used in file operations. An attacker can exploit this to execute code within the context of the current user. Recent reports indicate campaigns exploiting this issue using directory traversal and fileless Python payloads.

A vulnerabilidade permite que invasores remotos anexem documentos SVG especialmente criados a relatórios de problemas ou notas de bug. Quando um usuário ou administrador clica no anexo, o arquivo file download.php abre o documento SVG em uma guia do navegador, em vez de baixá-lo como um arquivo, fazendo com que o código JavaScript seja executado.