Sn0X-Sharma

**Name of the Vulnerable Software and Affected Versions** Typemill CMS versions 2.x **Description** A persistent cross-site scripting issue exists in the Markdown parser extension. Authenticated users with theme-configuration access can inject malicious JavaScript URIs by providing unsanitized `href` values in Markdown links. This is possible through `ParsedownExtension.php` or `TwigMarkdownExtension.php` by using the `javascript:` scheme. The stored payload executes in the browser of any visitor who clicks the link, which can lead to session cookie theft, authenticated request forgery, and credential harvesting. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ghidra (affected versions not specified) **Description** An arbitrary code execution issue exists in the Swift demangler analyzer. An attacker can execute arbitrary binaries by providing a malicious project containing a crafted Swift tool directory path. When the project is opened, the `SwiftDemanglerAnalyzer` restores the persisted Swift binary directory from the project state, and the `SwiftNativeDemangler` executes the resolved binary without performing integrity or signature verification. This allows attacker-controlled executables to run under the privileges of the Ghidra process user without any prompt or confirmation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RustDesk versions prior to 1.4.9 **Description** The server fails to enforce the authorized connection scope of a session. This allows a peer with limited session permissions, such as FileTransfer, PortForward, ViewCamera, or Terminal, to send control messages and login options that are intended only for full Remote sessions. An authenticated remote peer can exploit this lack of scope verification to inject out-of-scope control messages, enabling them to observe and control the host beyond their assigned permissions. **Recommendations** Update to version 1.4.9 or later.