Xavlimsg

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

A broken access control issue exists in the Account Resources user lookup endpoint. A remote authenticated user who owns at least one User-Managed Access (UMA) resource can enumerate and harvest personally identifiable information (PII) for all realm users. By sending crafted requests with arbitrary usernames or email values to the endpoint, the system returns full profile objects for unrelated users, resulting in broad profile-level information disclosure.

A flaw in the network enforcement of the Node.js Permission Model fails to apply required permission checks to Unix Domain Socket (UDS) server operations, although other comparable network paths are correctly enforced. This allows code executed with the `--permission` flag and without the `--allow-net` flag to create and expose local Inter-Process Communication (IPC) endpoints. Consequently, this enables communication with other processes on the same host, bypassing the intended network restriction boundary. The `--allow-net` feature is currently experimental.

The software contains an authentication bypass in the embedded SwiFTP FTP server component. This allows network attackers to log in without valid credentials by sending arbitrary username and password combinations to the `PASS` command handler, which unconditionally grants access. Successful exploitation allows attackers to list, read, write, and delete files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status.

The Remote Access Server feature in VideoLAN VLC for Android has an authentication bypass due to inadequate rate limiting on one-time password (OTP) verification. The server utilizes a 4-digit OTP but lacks effective throttling or lockout mechanisms during the OTP validity period. An attacker with network access can repeatedly attempt OTP verification to obtain a valid `user session` cookie, leading to unauthorized access to the Remote Access interface. Access is limited to media files shared by the VLC for Android user through the interface. The affected API endpoint is not explicitly mentioned.

A flaw exists in jishi node-sonos-http-api that could allow for remote execution of operating system commands. The issue is related to the manipulation of the `phrase` argument within the `Promise` function located in the `lib/tts-providers/mac-os.js` file of the TTS Provider component. The exploit for this issue has been publicly released.

The Galaxy FDS Android SDK disables TLS hostname verification when HTTPS is enabled by default. Specifically, the `createHttpClient()` function within the `GalaxyFDSClientImpl` class configures Apache HttpClient with `SSLSocketFactory.ALLOW ALL HOSTNAME VERIFIER`, accepting any TLS certificate regardless of hostname mismatch. This allows a man-in-the-middle attacker to intercept and modify communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.

An attacker can cause a denial of service by tricking the system into allocating excessive memory while processing DNS over QUIC or DNS over HTTP/3 payloads. In environments with significant available memory, this typically triggers an exception that closes the QUIC connection. However, in other scenarios, the system may enter an out-of-memory (OOM) state—a condition where the system lacks enough RAM to operate—resulting in the termination of the process and disruption of DNS resolution. This issue can be triggered by a single crafted QUIC packet and requires no authentication.