Markus Vervier

A flaw in the proxy server allows remote attackers to execute arbitrary code via bytecode rewriting. The issue exists because the `POST /guardrails/test custom code` endpoint runs user-supplied Python within a custom sandbox that can be escaped using bytecode-level techniques. This allows the execution of malicious code within the proxy process, which typically runs as root in the default Docker image. In default configurations, accessing this endpoint requires proxy-admin credentials.

Improper neutralization of special elements used in a command leads to a command injection issue in GitHub Copilot and Visual Studio, allowing an unauthorized attacker to execute code locally. This can be achieved through prompt injection, where an attacker hides malicious instructions within a repository comment, README, or PR description. The AI assistant may be tricked into modifying the `.vscode/settings.json` file to enable an auto-approve mode, which allows the agent to execute arbitrary bash commands in the terminal without human confirmation.

The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both.

The issue concerns arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim, allowing the attacker to fully control the user account. Wire-desktop clients connected to a vulnerable wire-webapp version are also vulnerable to this attack.

The issue is related to the use of a weak seed for random number generation, which leads to predictable AES keys used in NFC tags for local authorization of users. This may result in the total loss of trustworthiness of the installation.

Name of the Vulnerable Software and Affected Versions: Avira AntiVir Engine versions prior to 8.2.12.58 Description: A Denial of Service vulnerability exists due to an infinite loop in an unspecified function within the PDF Scanner Engine. Recommendations: For Avira AntiVir Engine versions prior to 8.2.12.58, update to version 8.2.12.58 or later to resolve the issue.

The issue is caused by a buffer overflow in the Texture Client Handler component of the Firefox browser, allowing a remote attacker to potentially cause a denial of service using a specially crafted web page. It can also lead to a crash and out-of-bounds read when a texture client's buffer is freed while still in use during graphic operations, potentially allowing the reading of memory from freed buffers.

The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file.

The issue allows attackers to hide data in the Graphical User Interface (GUI) view and create arbitrary entries to a certain extent by not properly escaping data before writing it into a Comma Separated Values (CSV) file. Special characters such as `"`, `,` and `r` are not escaped and can be used to add new entries to the log.

The issue allows FTP bounce scans to be performed by default, which can be exploited using commands like "nmap -b". This enables scans to be conducted via the FTP server.

The issue is caused by an integer overflow in the proto.c file of libotr, which can lead to memory corruption and application crash, or potentially allow execution of arbitrary code. This occurs when a series of large OTR messages are sent, triggering a heap-based buffer overflow. The issue is specific to 64-bit platforms.

The issue is related to a double free vulnerability in the writeDataError function within the ElasticSearch plugin (omelasticsearch) of rsyslog. This vulnerability can be exploited by remote attackers when the errorfile is set to local logging, allowing them to cause a denial of service (crash) and potentially execute arbitrary code via a crafted JSON response.

A double free issue in the PyPAM conv function in PAMmodule.c allows remote attackers to cause a denial of service, potentially leading to application crashes, or possibly execute arbitrary code. This can be achieved by including a NULL byte in a password string.