Junorouse

**Name of the Vulnerable Software and Affected Versions** guake versions prior to 3.8.5 **Description** The issue is related to the exposure of `execute command` and `execute command by uuid` methods via the d-bus interface, allowing a malicious user to run an arbitrary command. Exploitation requires the user to have installed another malicious program that can send dbus signals or run terminal commands. **Recommendations** For versions prior to 3.8.5, update to version 3.8.5 or later to resolve the issue. As a temporary workaround, consider disabling the `execute command` and `execute command by uuid` methods via the d-bus interface until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Parallels Desktop version 14.1.3 **Description** This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this issue. The specific flaw exists within the Parallels Service and results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to escalate privileges and execute code in the context of root. **Recommendations** For Parallels Desktop version 14.1.3, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 13.0.1 **Description** The issue is related to an inconsistent user interface that could be exploited by visiting a malicious website, potentially leading to user interface spoofing. **Recommendations** For versions prior to 13.0.1, update to Safari 13.0.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WPO WebPageTest version 19.04 **Description** The issue allows for Directory Traversal, enabling the reading of arbitrary files. This is due to an unanchored regular expression in the www/getfile.php file. An example of a malicious substring that can be used is 'a.jpg..'. **Recommendations** For WPO WebPageTest version 19.04, consider restricting access to the www/getfile.php file until a patch is available. As a temporary workaround, avoid using unanchored regular expressions in the file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mistune version 0.7.4 **Description** The issue allows for XSS attacks through unexpected newlines or crafted email addresses, related to the escape and autolink functions. **Recommendations** For Mistune version 0.7.4, consider updating to a newer version that addresses this issue, as the current version allows for XSS attacks via specific input manipulations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.