Ciphersecuritylabs

**Name of the Vulnerable Software and Affected Versions** BareBones BBEdit versions prior to 16.0 **Description** A flaw in the Java Language Module of the software allows for remote exploitation. The issue occurs within an unknown function of this module, where specific manipulation can trigger uncontrolled recursion, potentially leading to a system crash or denial of service. **Recommendations** Update to version 16.0.

**Name of the Vulnerable Software and Affected Versions** BareBones BBEdit versions prior to 16.0 **Description** A remote attack can trigger an infinite loop within an unknown function of the Lasso Language Tokenizer component. An infinite loop is a condition where a sequence of instructions continues to execute indefinitely, potentially causing the application to become unresponsive. **Recommendations** Update to version 16.0.

**Name of the Vulnerable Software and Affected Versions** Cozmoslabs Profile Builder Plugin versions prior to 3.16.2 **Description** An unrestricted upload issue exists in the Avatar Simple Upload AJAX Handler component. A remote attacker can manipulate the `wppb ajax simple avatar()` function within the '/wp-admin/admin-ajax.php' endpoint to upload files without proper restrictions. **Recommendations** Update to version 3.16.2.

**Name of the Vulnerable Software and Affected Versions** CodeChecker (affected versions not specified) **Description** The `massStoreRun` processing path performs one-shot decompression of Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permissions to store analysis runs can submit a highly compressed payload that expands into a significantly larger byte sequence. Since the decompressed output is materialized in memory before being written to a temporary file, a large payload can exhaust process or host memory and consume substantial disk space, leading to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.