Lukas Euler

Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the ` .unset` and ` .omit` functions. An attacker can leverage crafted paths to trigger the deletion of methods from global prototypes. The issue allows for property deletion but does not permit modification of the original behavior of those properties.

The travel-support-program, a rails app supporting the openSUSE travel support program, is affected by a Ransack query injection issue. This allows sensitive user data, including bank account details and password hashes, to be extracted. The issue is exploited through the `* start`, `* end`, or `* cont` search matchers in the Ransack library, using character-by-character brute-force. A single bank account number can be extracted with less than 200 requests, and a password hash can be extracted with approximately 1200 requests, all within a few minutes.

The issue is related to incorrect code generation management in Microsoft Office. It allows a remote attacker to execute arbitrary code.

The issue is related to the handling of non-http(s) hyperlinks in Apache OpenOffice, which can lead to untrusted code execution if a link is specifically crafted. This problem has existed since about 2006. It is recommended to be careful when opening documents from unknown and unverified sources.

The issue is related to errors in security settings, allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. This can be achieved by manipulating a link to circumvent the denylist, resulting in ShellExecute attempting to launch an executable type.

Name of the Vulnerable Software and Affected Versions: Wireshark versions 3.2.0 through 3.2.11 Wireshark versions 3.4.0 through 3.4.3 Description: The issue is related to improper URL handling, which could allow remote code execution via packet injection or crafted capture files. Recommendations: For Wireshark versions 3.2.0 through 3.2.11, update to a version outside of this range to resolve the issue. For Wireshark versions 3.4.0 through 3.4.3, update to a version outside of this range to resolve the issue.

An issue in OpenStack blazar-dashboard allows a user with access to the Blazar dashboard in Horizon to trigger code execution on the Horizon host. This is due to the use of the Python `eval` function, which may result in unauthorized access to the Horizon host and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.