Joe

Nome do software vulnerável e versões afetadas: Versões do Backdrop CMS anteriores à 1.28.4 Versões do Backdrop CMS 1.29.x anteriores à 1.29.2 Descrição: A vulnerabilidade permite ataques de Cross Site Scripting (XSS) por meio de um documento SVG, caso a tag SVG seja permitida no formato de texto. Isso ocorre no Backdrop CMS quando um documento SVG é utilizado. Recomendações: Para versões anteriores à 1.28.4, atualize para a versão 1.28.4 ou posterior. Para versões 1.29.x anteriores à 1.29.2, atualize para a versão 1.29.2 ou posterior. Como solução temporária, considere desativar o uso de tags SVG para formatos de texto até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** FastCGI versions 2.4.0 **Description** The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and crash, by establishing a large number of connections. **Recommendations** For FastCGI version 2.4.0, consider restricting the number of incoming connections to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP versions prior to 2.8.1 **Description** The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a malformed XTENSION header of a .fit file. This can be achieved by using a long string. **Recommendations** For versions prior to 2.8.1, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of malformed .fit files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Msinfo32.exe (affected versions not specified) **Description** A buffer overflow issue exists in Microsoft Msinfo32.exe, potentially allowing local users to execute arbitrary code. This can be achieved by providing a long filename in the `msinfo file` command line parameter. It is noted that this issue might not cross security boundaries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.