Cipher-Creator

**Name of the Vulnerable Software and Affected Versions** Hasura versions prior to 2.49.2 Hasura versions prior to 2.45.5 **Description** A flaw exists where a user can employ a where clause on a table computed field that returns `SETOF some table` to infer row values. This occurs even when those rows should be filtered based on the row-level permissions of `some table`. Although the rows cannot be returned directly, string predicates allow values to be brute forced by using the where clause as an oracle, which is a technique used to extract data by observing the application's response to specific queries. **Recommendations** Update to version 2.49.2 or later. Update to version 2.45.5 or later.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0698 **Description** A stack out-of-bounds write occurs in the single-byte branch of the `spell soundfold sofo()` function within `src/spell.c`. When a SOFO-based spell language is active, the copy loop translates a word using a sound-folding (SOFO) byte map into a caller-owned result buffer. Because the output index `ri` advances without an upper bound and only terminates on the input NUL, any word longer than the `MAXWLEN`-element stack buffer will write past the buffer's end. This corrupts the call frame and causes the editor to crash. This issue can be triggered when a word exceeding `MAXWLEN` is passed to `soundfold()` or reached via sound-based spell suggestions. **Recommendations** Update to version 9.2.0698.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0670 **Description** The `get text props()` function in `src/textprop.c` reads a `uint16` property count stored inline after a line's text and returns it as the number of 32-byte `textprop T` entries that follow. Because the count is not verified against the actual amount of data present, a line declaring a large count with minimal data can cause the system to read beyond the end of the line buffer. This issue can be triggered via a crafted undo file, resulting in a crash. **Recommendations** Update to version 9.2.0670.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0671 **Description** When opening a file encrypted using the VimCrypt~04! or VimCrypt~05! methods (which utilize xchacha20poly1305 and require the +sodium feature), an unsigned length calculation underflows if the file body is shorter than a single libsodium secretstream header. This leads to a decryption call that reads beyond the end of the input buffer, resulting in a crash of the application. **Recommendations** Update to version 9.2.0671.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0663 **Description** A Vimscript code injection issue exists in the `s:NetrwLocalRmFile()` function within the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. The problem occurs because a filename from the buffer's directory listing is interpolated into an Ex command line passed to `:execute` with only the backslash character escaped. An attacker can use a crafted filename containing a bar (|) character to terminate the intended command and execute arbitrary Vimscript, which may include shell commands via `:call system()` and `:!`. **Recommendations** Update to version 9.2.0663.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0662 **Description** The `dump prefixes()` function in src/spell.c iteratively walks a spell-file prefix trie using a depth counter to dump prefixes applying to a word. Because the counter is not checked against the size of the fixed MAXWLEN-element stack arrays it indexes (`prefix[]`, `arridx[]`, and `curi[]`), a specially crafted .spl file can cause the descent to go arbitrarily deep. This results in a stack out-of-bounds write, which corrupts the call frame and causes the editor to crash. **Recommendations** Update to version 9.2.0662.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0653 **Description** The `tree count words()` function in src/spellfile.c fails to validate a depth counter against the size of fixed MAXWLEN-element stack arrays, specifically `arridx[]`, `curi[]`, and `wordcount[]`. A specially crafted .spl/.sug file pair can trigger an arbitrarily deep descent during spell suggestion, resulting in a stack out-of-bounds write. This memory corruption affects the call frame and leads to an application crash. **Recommendations** Update to version 9.2.0653.