Marcio Almeida

Insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

Insufficient validation of client-supplied state in the RadImageEditor control allows an attacker to influence which file is returned by the image cache. This can lead to the exposure of file contents located outside the intended image directories.

The RadAsyncUpload component contains a flaw in client-state processing where the system can distinguish between decryption failures and invalid-JSON parse failures. This behavior creates a decryption oracle, allowing remote attackers to reveal protected metadata values.

The RadAsyncUpload component contains a timing side-channel issue during the processing of upload metadata. This allows remote attackers to recover protected metadata values by analyzing measurable timing differences to determine cryptographic validity.

When the `Telerik.Upload.ConfigurationHashKey` is absent and the `machineKey` is not explicitly configured, the integrity protection for upload metadata may revert to a predictable default key. This allows attackers to forge protected upload metadata, which can be used to facilitate further exploit chains.

Input provided to the `DialogHandler` provider type can be tampered with, which may allow an attacker to alter how dialogs are processed and potentially enable chained exploitation.

Forged upload metadata can influence the processing of `AsyncUploadTypeName`, leading to unsafe attacker-controlled type resolution. This flaw allows for remote code execution in affected deployments.

Insufficient validation of content submitted to the RadEditor PDF export feature allows an authenticated attacker to trigger server-side requests to arbitrary hosts. This can lead to outbound network connections and the potential exposure of Windows authentication credentials.

The internal LayoutBuilder control processes client-state XML without disabling Document Type Definition (DTD) processing. This allows an unauthenticated attacker to cause a denial of service through recursive XML entity expansion, a technique where nested entities are used to exhaust system resources.

The obsolete RadChart component contains a flaw in the 'ChartImage.axd' endpoint that allows unauthenticated users to read and delete files with image extensions located within the application directory.

Request parameters within the 'DialogHandler' may be tampered with, which could allow an attacker to alter the server-side behavior of dialogs and facilitate chained exploitation.

Insufficient validation of the `language` parameter in the spell check handler allows an attacker to influence server-side file path resolution. This can lead to the triggering of unintended server-side requests.

The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string processing, potentially enabling attackers to execute arbitrary JavaScript code within the application's context. The vulnerability allows for remote code execution via cookies and imports.

The issue allows a shortcut to potentially bypass sensitive Shortcuts app settings. This is addressed by adding an additional prompt for user consent. The vulnerability may enable arbitrary command execution and file leaks across all Apple devices.

The issue allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a `@font-face` rule. This is related to the `registerFont` function in `FontMetrics.php`.