Vulnerabilidades

GitHub CLI (gh) is GitHub’s official command line tool. From 2.10.0 through 2.95.0, connecting to a malicious Codespace with gh codespace jupyter can allow command execution because the command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS…

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard…

Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

La neutralización incorrecta de la entrada durante la generación de páginas web ('secuencias de comandos en sitios cruzados') en Microsoft Edge (Chromium-based) permite a un atacante no autorizado realizar suplantación a través de una red.

Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.

La neutralización incorrecta de la entrada durante la generación de páginas web ('secuencias de comandos en sitios cruzados') en Microsoft Edge (Chromium-based) permite a un atacante no autorizado realizar suplantación a través de una red.

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Un uso después de liberar (use-after-free) en Microsoft Edge (basado en Chromium) permite a un atacante no autorizado ejecutar código a través de una red.

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

El acceso a un recurso usando un tipo incompatible ('confusión de tipos') en Microsoft Edge (basado en Chromium) permite a un atacante no autorizado ejecutar código a través de una red.

El acceso a un recurso usando un tipo incompatible ('confusión de tipos') en Microsoft Edge (basado en Chromium) permite a un atacante no autorizado ejecutar código a través de una red.

Un uso después de liberar (use-after-free) en Microsoft Edge (basado en Chromium) permite a un atacante no autorizado ejecutar código a través de una red.

Un uso después de liberar (use-after-free) en Microsoft Edge (basado en Chromium) permite a un atacante no autorizado ejecutar código a través de una red.

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

El acceso a un recurso usando un tipo incompatible ('confusión de tipos') en Microsoft Edge (basado en Chromium) permite a un atacante no autorizado ejecutar código a través de una red.

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.