James Davis

O problema está relacionado à autorização inadequada de um índice contendo informações confidenciais provenientes de uma pesquisa de Arquivos Globais no Windows Defender, permitindo que um invasor autorizado divulgue informações através de uma rede. Isso se deve ao fato de o mecanismo de indexação não limitar adequadamente o acesso aos usuários autorizados a visualizar as informações originais. Não há conhecimento de explorações da vulnerabilidade, apesar da baixa complexidade do ataque.

A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument `uri` leads to inefficient regular expression complexity.

The issue is related to a Regular Expression Denial of Service (ReDoS) in the lib/bson/decimal128.js file. It occurs when the `Decimal128.fromString()` function is used to parse a long untrusted string.

An issue was discovered in the django.utils.html.urlize() function, which was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the `django.utils.text.Truncator` class, specifically in its `chars()` and `words()` methods when the `html=True` argument is passed. This vulnerability affects the `truncatechars html` and `truncatewords html` template filters. An attacker could exploit this by crafting a string that leads to a denial of service.

The issue concerns a potential regular expression denial of service (ReDoS) vector in the `'path'` module. This module is used for various path parsing functions, including `path.dirname()`, `path.extname()`, and `path.parse()`. An attacker can craft a string that, when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.

The issue is related to a cross-site scripting (XSS) vulnerability. It occurs when the WiFi Transfer feature is used, allowing remote attackers to inject arbitrary web script or HTML via a crafted map name.

The issue allows remote attackers to cause a denial of service by consuming disk space through uploading a large file. This is related to the iThoughts web server in the iThoughtsHD app on iPad devices.

The issue allows remote attackers to upload arbitrary files by exploiting the WiFi Transfer feature. This is achieved by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.