Hessandrew

**Name of the Vulnerable Software and Affected Versions** xrdp versions prior to 0.10.6 **Description** An open source RDP server contains a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation. This occurs due to insufficient validation of client-controlled size parameters, which allows an out-of-bounds write via crafted PDUs (Protocol Data Units). Pre-authentication exploitation can cause the process to crash, while post-authentication exploitation may lead to remote code execution. **Recommendations** Update to version 0.10.6. Run xrdp as a non-privileged user to limit the impact of successful exploitation.

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.79.1 Description Payload, a headless content management system, had insufficient input validation in certain requests. This allowed attackers to manipulate SQL query execution, potentially leading to data exposure or modification in collections. Recommendations Upgrade to version 3.79.1 or later.