Justinsteven

**Name of the Vulnerable Software and Affected Versions** github.com/containrrr/shoutrrr/pkg/util versions prior to 0.6.0 **Description** The issue is related to a Denial of Service (DoS) that can be triggered via the `util.PartitionMessage` function by sending messages of exactly 2000, 4000, or 6000 characters in length. This can cause a panic when sending such a message to Discord. **Recommendations** For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue. As a temporary workaround, consider disabling the `util.PartitionMessage` function until a patch is available. Avoid sending messages of exactly 2000, 4000, or 6000 characters in length to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** check-spelling versions prior to v0.0.19 **Description** The issue is related to the exposure of the `GITHUB TOKEN` in the check-spelling GitHub action, which can be triggered by a crafted Pull Request. This exposure allows an attacker to push commits to the repository, bypassing standard approval processes, and potentially steal secrets available to the repository. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** To resolve the issue, users can either: - Update to version v0.0.19 or later. - Disable the workflow until all branches are fixed. - Set repository to Allow specific actions and explicitly add other actions that the repository uses. - Set repository Workflow permissions to Read repository contents permission. For workflows using a pinned sha or tagged version, change the affected workflows for all repository branches to the latest version. As a temporary workaround, consider disabling the vulnerable workflow until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `GITHUB TOKEN` in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Metasploit msfvenom framework (affected versions not specified) **Description** The issue allows a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine, due to the way Rapid7's Metasploit msfvenom framework handles APK files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Visual Studio Code (affected versions not specified) Description: A remote code execution issue exists when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploits this could run arbitrary code in the context of the current user. If the current user has administrative rights, an attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. To exploit this, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code, executing attacker-specified code when the malicious 'package.json' file is opened. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** fwupd (all versions) **Description** A PGP signature bypass flaw was found, which could lead to the installation of unsigned firmware. The highest threat from this vulnerability is to confidentiality and integrity. It is theoretically possible but not practical because the Linux Vendor Firmware Service (LVFS) is either not implemented or enabled in versions of fwupd shipped with Red Hat Enterprise Linux 7 and 8. Approximately 500,000 unique IP addresses are affected. **Recommendations** As a temporary workaround, consider disabling the signature verification process until a patch is available. Restrict access to the LVFS to minimize the risk of exploitation. Avoid using fwupd until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rbenv (all current versions) **Description** The issue allows for Directory Traversal in the specification of Ruby version, resulting in arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.