Karan Bamal

Name of the Vulnerable Software and Affected Versions: Visual Studio (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability in the Visual Studio installer, which is associated with an uncontrolled search path element. Exploitation of this issue may allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue was discovered in the installer of Samsung Portable SSD for T5 on Windows, allowing an attacker to tamper with the directory and DLL files used during the installation process. This can lead to privilege escalation through arbitrary code execution, but the attacker must already have user privileges.

An issue was discovered in the OAuth 2.0 implementation, where the `state` parameter was not properly validated. This leaves applications vulnerable to Cross-Site Request Forgery (CSRF) attacks during authentication and authorization operations.

The issue is related to a Time-of-check Time-of-use (TOCTOU) Race Condition, which may allow escalation of permission to the system user if successfully exploited.

The issue is related to Server-side Request Forgery (SSRF) via img tags. It allows a remote attacker to access confidential data due to insufficient request validation. To reduce the risk, using trustedSchemes and trustedHosts as specified in Reportlab's documentation is recommended. The vulnerability can be exploited by injecting an img tag with a malicious src attribute into a text file that is converted to PDF. This can be demonstrated by following specific steps, including downloading and installing the latest package of reportlab, injecting a malicious img tag into a text file, and creating a netcat listener to capture the server-side request.