Ky0Tofu

Missing authorization in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Improper access control in .NET allows an authorized attacker to elevate privileges locally.

A time-of-check time-of-use (toctou) race condition exists in the `dotnet-watch` component of the .NET SDK. A toctou race condition occurs when a program checks the state of a resource and then acts upon that resource, but the state changes between the check and the action. This flaw allows an authorized local attacker to replace or modify a temporary solution file used by `dotnet-watch`, which can lead to the alteration of a subsequent build and local privilege elevation. This issue affects Linux and macOS platforms.

An issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network, which enables them to affect the system.

A use after free issue in the Windows Bluetooth Service allows an unauthorized attacker to execute arbitrary code over an adjacent network, which can affect the system. Use after free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

An issue in .NET allows an authorized attacker to elevate privileges locally through the exposure of sensitive information to an unauthorized actor.

Nexus Repository 3 fails to validate the destination URL configured in the "Webhook: Global" capability before initiating outbound HTTP requests. This allows a user with Capability Administration permissions to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making requests to internal network locations. This action can be triggered by authenticated users with the required role or by unauthenticated users if the anonymous role has been granted the Capability Administration permission.

Improper authorization in the .NET software platform allows an authorized attacker to elevate privileges locally.

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

A heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when an application writes more data to a heap-allocated memory block than it can hold, potentially leading to memory corruption.

An authenticated user with upload permissions to a hosted repository can store content that triggers arbitrary JavaScript execution in the browser of any user viewing that repository directory through the HTML index page. This allows an attacker to perform actions within the context of the victim's session.

A local unprivileged user can trigger an assert when a unit with `Delegate=yes` and `User=<unset>` is running.

The Shopire theme for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the `shopire admin install plugin()` function. Attackers with Subscriber-level access or higher can install the 'fable-extra' plugin.