L8Bl

A time-of-check time-of-use (toctou) race condition exists in the `dotnet-watch` component of the .NET SDK. A toctou race condition occurs when a program checks the state of a resource and then acts upon that resource, but the state changes between the check and the action. This flaw allows an authorized local attacker to replace or modify a temporary solution file used by `dotnet-watch`, which can lead to the alteration of a subsequent build and local privilege elevation. This issue affects Linux and macOS platforms.

An authorized attacker can elevate privileges locally due to the creation of temporary files in a directory with insecure permissions.

An issue exists where sensitive information is inserted into log files, which allows an authorized attacker to disclose this information locally.

Untrusted search path in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Improper resolution of path equivalence allows an unauthorized attacker to bypass security restrictions locally.

The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the `listen.allowed clients` check to match based on a /96 prefix rather than the exact address. An attacker using an address that shares the first 96 bits with an authorized address can bypass the access control and reach the FastCGI endpoint.

A missing authorization issue exists in LifePress due to incorrectly configured access control security levels. This allows for potential exploitation.

Atheos is a self-hosted browser-based cloud integrated development environment. The improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.

WeGIA is a Web manager for charitable institutions. An OS Command Injection issue was discovered, allowing an attacker to execute arbitrary code remotely via the `importar dump.php` endpoint. This could also enable a webshell upload.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `deletar cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Recommendations: For WeGIA versions prior to 3.2.13, upgrade to version 3.2.13 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `deletar cargo.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, affecting the `informacao adicional.php` endpoint. This issue could allow an attacker to execute arbitrary SQL queries, resulting in unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to resolve the issue. As a temporary workaround, consider restricting access to the `informacao adicional.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `familiar docfamiliar.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `familiar docfamiliar.php` endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection issue was discovered in the WeGIA application, affecting the `documento excluir.php` endpoint. This could allow an attacker to execute arbitrary SQL queries, enabling unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to resolve the issue. As a temporary workaround, consider restricting access to the `documento excluir.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, `gerenciar backup.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the issue. As a temporary workaround, consider restricting access to the `gerenciar backup.php` endpoint until the upgrade is applied. There are no known workarounds for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `restaurante produto desocultar.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `restaurante produto desocultar.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A SQL Injection vulnerability was discovered in the WeGIA application, at the `historico paciente.php` endpoint. This issue could allow an attacker to execute arbitrary SQL queries, enabling unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the SQL Injection vulnerability. As a temporary workaround, consider restricting access to the `historico paciente.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `deletar documento.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to address the issue. As a temporary workaround, consider restricting access to the `deletar documento.php` endpoint until the upgrade is applied. There are no known workarounds for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.14 Description: A Path Traversal vulnerability was discovered in the WeGIA application, affecting the `examples.php` endpoint. This issue could allow an attacker to gain unauthorized access to sensitive information stored in `config.php`, which contains data that could permit direct access to the database. Recommendations: For versions prior to 3.2.14, upgrade to version 3.2.14 to secure sensitive information stored in `config.php`. As a temporary workaround, consider restricting access to the `examples.php` endpoint until the upgrade is applied. Additionally, avoid using the `config.php` file in a way that could expose its contents until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection issue was discovered in the WeGIA application, affecting the `dependente docdependente.php` endpoint. This could allow an attacker to execute arbitrary SQL queries, enabling unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the issue. As a temporary workaround, consider restricting access to the `dependente docdependente.php` endpoint until the upgrade is applied.

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.13 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `remover produto.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. Recommendations: For versions prior to 3.2.13, upgrade to version 3.2.13 to address the issue. As a temporary workaround, consider restricting access to the `remover produto.php` endpoint until the upgrade is applied.