Loknop

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 125.0.6422.76 **Description** The issue is related to a heap buffer overflow in the ANGLE library used by Google Chrome, allowing a remote attacker to perform an out of bounds memory read via a crafted HTML page. This can potentially lead to the execution of arbitrary code. The vulnerability is associated with a type confusion error that can be activated on a specially crafted malicious HTML page. **Recommendations** For Google Chrome versions prior to 125.0.6422.76, update to version 125.0.6422.76 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted HTML pages that could exploit the heap buffer overflow in the ANGLE library. Restrict access to potentially malicious web content to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Trix editor versions prior to 2.1.1 Trix editor versions prior to 2.1.4 **Description** The Trix editor is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. This vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. An attacker could exploit this vulnerability to execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed. **Recommendations** For Trix editor versions prior to 2.1.1, users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content. For Trix editor versions prior to 2.1.4, users should upgrade to Trix editor version 2.1.4 or later, which incorporates proper sanitization of input from copied content. As a temporary workaround, consider enhancing the Content Security Policy (CSP) to disallow inline scripts by setting CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** The issue occurs due to an input validation error when importing lesson questions, resulting in insufficient path checks. This leads to an arbitrary file read risk, allowing a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers, and admins by default. The vulnerability can be exploited by a remote attacker to disclose protected information by sending a specially crafted HTTP request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.