Fahad Alamri

**Name of the Vulnerable Software and Affected Versions** WD Discovery versions prior to 5.0.589 **Description** The issue is related to a misconfiguration in the Node.js environment settings of WD Discovery, which could allow code execution by utilizing the `ELECTRON RUN AS NODE` environment variable. Any malicious application operating with standard user permissions can exploit this, enabling code execution within the WD Discovery application's context. The attack vector requires the victim to have the WD Discovery app installed on their device. **Recommendations** For versions prior to 5.0.589, update to version 5.0.589, which addresses this issue by disabling certain features and fuses in Electron. As a temporary workaround, consider restricting access to the `ELECTRON RUN AS NODE` environment variable to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge for Android (Chromium-based) (affected versions not specified) **Description** The issue is related to errors in handling files, specifically cookies, which can allow a remote attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Remote Desktop Manager versions 2023.3.9.3 and earlier **Description** The issue allows an attacker to execute code via the `DYLIB INSERT LIBRARIES` environment variable. This is a code injection problem in Remote Desktop Manager on macOS. **Recommendations** For Remote Desktop Manager versions 2023.3.9.3 and earlier, consider restricting the use of the `DYLIB INSERT LIBRARIES` environment variable to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.