Maherazzouzi

**Name of the Vulnerable Software and Affected Versions** Dgraph versions prior to 25.3.3 **Description** Dgraph exposes the process command line through the unauthenticated '/debug/vars' endpoint on Alpha. Since the admin token is often provided via the `--security` startup flag, an unauthenticated attacker can retrieve this token and use it in the `X-Dgraph-AuthToken` header to gain access to admin-only endpoints. This occurs because the system continues to serve the http.DefaultServeMux, which includes the expvar's '/debug/vars' handler. **Recommendations** Update to version 25.3.3.

**Name of the Vulnerable Software and Affected Versions** Enlightenment versions prior to 0.25.4 **Description** The issue is related to the Enlightenment window manager's system file, specifically with the `enlightenment sys` component. It is setuid root and mishandles pathnames that begin with a `/dev/..` substring, allowing local users to gain privileges. This can lead to privilege escalation, potentially giving an attacker root privileges. The exploit has been tested on Ubuntu 22.04 but is expected to work on other distributions as well. **Recommendations** For versions prior to 0.25.4, update to version 0.25.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `enlightenment sys` component until a patch is available. Avoid using pathnames that begin with a `/dev/..` substring in the affected system library function.