James Davis

The issue is related to improper authorization of an index containing sensitive information from a Global Files search in Windows Defender, allowing an authorized attacker to disclose information over a network. This is due to the mechanism of indexing not properly limiting access to actors who are authorized to see the original information. There have been no known exploitations of the vulnerability, despite the attack complexity being low.

A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument `uri` leads to inefficient regular expression complexity.

The issue is related to a Regular Expression Denial of Service (ReDoS) in the lib/bson/decimal128.js file. It occurs when the `Decimal128.fromString()` function is used to parse a long untrusted string.

An issue was discovered in the django.utils.html.urlize() function, which was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the `django.utils.text.Truncator` class, specifically in its `chars()` and `words()` methods when the `html=True` argument is passed. This vulnerability affects the `truncatechars html` and `truncatewords html` template filters. An attacker could exploit this by crafting a string that leads to a denial of service.

The issue concerns a potential regular expression denial of service (ReDoS) vector in the `'path'` module. This module is used for various path parsing functions, including `path.dirname()`, `path.extname()`, and `path.parse()`. An attacker can craft a string that, when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.

The issue is related to a cross-site scripting (XSS) vulnerability. It occurs when the WiFi Transfer feature is used, allowing remote attackers to inject arbitrary web script or HTML via a crafted map name.

The issue allows remote attackers to cause a denial of service by consuming disk space through uploading a large file. This is related to the iThoughts web server in the iThoughtsHD app on iPad devices.

The issue allows remote attackers to upload arbitrary files by exploiting the WiFi Transfer feature. This is achieved by placing a %00 sequence after a dangerous extension, as demonstrated by a .html%00.txt file.