Quart27219

**Name of the Vulnerable Software and Affected Versions** ardupilot versions prior to Plane-4.6.4 **Description** An out-of-bounds read issue exists in the `GCS MAVLINK::handle serial control()` function within the `libraries/GCS MAVLink/GCS serial control.cpp` file. An out-of-bounds read occurs when a program reads data past the end of the intended buffer, which can lead to system instability or information disclosure. **Recommendations** Update ardupilot to version Plane-4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** webrick versions prior to 1.9.3 **Description** WEBrick reparses the trailer Content-Length into the canonical request state, which enables request smuggling. Request smuggling is a technique that interferes with the way a website processes sequences of HTTP requests, potentially allowing an attacker to bypass security controls or poison caches. **Recommendations** Update webrick to version 1.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Notepad3 versions prior to 6.25.822.2 **Description** A DLL search-order hijacking issue exists in the About-dialog code path within `src/Notepad3.c`. The application uses the `LoadLibrary()` function to load `MSFTEDIT.DLL` using a bare name. This allows a local attacker to place a malicious version of the DLL in the application directory or other search locations, leading to arbitrary code execution in the user context when the About dialog is opened. **Recommendations** Update Notepad3 to a version newer than 6.25.822.1.

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.7 **Description** An authenticated user can create a public share for an arbitrary path that does not yet exist. The system stores the share record without verifying the file's existence. Consequently, if a file is later created at that specific path, the previously established public share becomes active, exposing the new file to unauthorized access. This occurs because the share is linked to a path string rather than a specific object existing at the time of creation. Technical details include: - API Endpoints: `POST /api/share/<path>` is used to create the share, and `GET /api/public/dl/<hash>` or `GET /api/public/share/<hash>` are used to access the file. - Vulnerable Function: `sharePostHandler()` fails to perform an existence check before saving the share link. **Recommendations** Update File Browser to version 2.63.7.

**Name of the Vulnerable Software and Affected Versions** transmission versions prior to 4.1.2 **Description** A clickjacking weakness exists in the browser-facing WebUI and RPC response paths. Clickjacking is a technique where an attacker uses transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. **Recommendations** Update to version 4.1.2 or later.