Ryotak

**Name of the Vulnerable Software and Affected Versions** Go (affected versions not specified) **Description** A difference in how Go and C/C++ interpret comments can allow malicious code to be hidden within the compiled binary when using cgo. This technique, known as code smuggling, enables attackers to inject code that may be executed unexpectedly. There is no information available regarding the number of potentially affected devices or any real-world incidents where this issue has been exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 **Description** A privilege escalation issue exists in the Netmonitor component. This allows for unauthorized access and potential control over the system. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird to version 140.8 or later.

**Name of the Vulnerable Software and Affected Versions** Looker versions prior to 24.12.108 Looker versions prior to 24.18.200 Looker versions prior to 25.0.78 Looker versions prior to 25.6.65 Looker versions prior to 25.8.47 Looker versions prior to 25.12.10 Looker versions prior to 25.14 **Description** A user with Developer role can create a database connection using the Denodo driver and manipulate LookML to cause Looker to execute a malicious command. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances, requiring no user action. **Recommendations** Upgrade self-hosted instances to version 24.12.108 or later. Upgrade self-hosted instances to version 24.18.200 or later. Upgrade self-hosted instances to version 25.0.78 or later. Upgrade self-hosted instances to version 25.6.65 or later. Upgrade self-hosted instances to version 25.8.47 or later. Upgrade self-hosted instances to version 25.12.10 or later. Upgrade self-hosted instances to version 25.14 or later.

**Name of the Vulnerable Software and Affected Versions** Looker versions prior to 25.0.93 Looker versions prior to 25.6.84 Looker versions prior to 25.12.42 Looker versions prior to 25.14.50 Looker versions prior to 25.16.44 **Description** A user with a Developer role can create a database connection using the IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command. This is due to insufficient filtering of the driver’s parameters. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances and does not require user action. **Recommendations** Upgrade self-hosted instances to version 25.0.93 or later. Upgrade self-hosted instances to version 25.6.84 or later. Upgrade self-hosted instances to version 25.12.42 or later. Upgrade self-hosted instances to version 25.14.50 or later. Upgrade self-hosted instances to version 25.16.44 or later.

**Name of the Vulnerable Software and Affected Versions** Looker versions prior to 24.12.103 Looker versions prior to 24.18.195 Looker versions prior to 25.0.72 Looker versions prior to 25.6.60 Looker versions prior to 25.8.42 Looker versions prior to 25.10.22 **Description** An attacker with a Looker Developer role could manipulate a LookML project to exploit a race condition during Git directory deletion, potentially leading to arbitrary command execution on the Looker instance. This issue affects both Looker-hosted and self-hosted instances. The issue has been mitigated for Looker-hosted instances, requiring no user action. **Recommendations** Upgrade to Looker version 24.12.103 or later. Upgrade to Looker version 24.18.195 or later. Upgrade to Looker version 25.0.72 or later. Upgrade to Looker version 25.6.60 or later. Upgrade to Looker version 25.8.42 or later. Upgrade to Looker version 25.10.22 or later.

**Name of the Vulnerable Software and Affected Versions** Rust versions 1.87.0 through 1.88.9 **Description** The standard library’s Path API did not correctly handle path separators on the tier 3 Cygwin target (`x86 64-pc-cygwin`) in versions prior to 1.89.0. This caused the API to ignore path components separated by backslashes. Programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations. The issue was resolved in Rust 1.89.0 by correctly handling both Win32 and Unix style paths for the Cygwin target. The tier 3 Cygwin compilation target is only available when building from source and is not available through pre-built binaries or Rustup. **Recommendations** Update to Rust version 1.89.0 or later.

**Name of the Vulnerable Software and Affected Versions** NEC Corporation UNIVERGE IX versions 9.5 through 10.7 NEC Corporation UNIVERGE IX versions 10.8.21 through 10.8.36 NEC Corporation UNIVERGE IX versions 10.9.11 through 10.9.24 NEC Corporation UNIVERGE IX versions 10.10.21 through 10.10.31 NEC Corporation UNIVERGE IX version 10.11.6 NEC Corporation UNIVERGE IX-R/IX-V versions 1.3.16 and 1.3.21 **Description** A cross-site scripting issue exists in NEC Corporation UNIVERGE IX and UNIVERGE IX-R/IX-V. This allows an attacker to inject arbitrary scripts that may be executed in the user's browser. **Recommendations** Update NEC Corporation UNIVERGE IX to a version later than 10.7. Update NEC Corporation UNIVERGE IX to a version later than 10.8.36. Update NEC Corporation UNIVERGE IX to a version later than 10.9.24. Update NEC Corporation UNIVERGE IX to a version later than 10.10.31. Update NEC Corporation UNIVERGE IX to a version later than 10.11.6. Update NEC Corporation UNIVERGE IX-R/IX-V to a version later than 1.3.21.

**Name of the Vulnerable Software and Affected Versions:** PostgreSQL versions prior to 17.6 PostgreSQL versions prior to 16.10 PostgreSQL versions prior to 15.14 PostgreSQL versions prior to 14.19 PostgreSQL versions prior to 13.22 **Description:** The vulnerability relates to untrusted data inclusion within the `pg dump` utility. Exploitation allows a malicious superuser of the origin server to inject arbitrary code for execution during restore operations performed by the `psql` client. This affects `pg dumpall` and `pg restore` when used to generate plain-format dumps. Approximately 3.3 million devices are estimated to be affected. The issue allows for remote code execution. **Recommendations:** Update to PostgreSQL version 17.6 or later. Update to PostgreSQL version 16.10 or later. Update to PostgreSQL version 15.14 or later. Update to PostgreSQL version 14.19 or later. Update to PostgreSQL version 13.22 or later. As a temporary workaround, use the `--no-comments` option during `pg restore` operations.

**Name of the Vulnerable Software and Affected Versions** Unity versions 2017.1 through 6000.3 **Description** A critical vulnerability exists in the Unity Runtime, potentially allowing attackers to execute arbitrary code on systems running applications built with affected versions of the engine. This vulnerability, identified as CVE-2025-59489, stems from an untrusted search path issue, enabling the loading of malicious code through crafted command-line arguments. While primarily a local code execution risk, remote exploitation is possible under specific conditions on Android. No known exploits have been reported to date. The vulnerability affects applications built with Unity versions 2017.1 and later for Windows, Android, macOS, and Linux. Microsoft and Valve have implemented mitigations, and Unity has released patches and a binary patching tool. **Recommendations** Update to the latest patched Unity Editor and rebuild applications to address the vulnerability. If rebuilding is not feasible, utilize the Unity binary patching tool, but note that it may not be compatible with applications employing anti-cheat or tamper protection. Ensure automatic updates are enabled for games and applications.

**Name of the Vulnerable Software and Affected Versions** cmd/go (affected versions not specified) **Description** A malicious file created using cmd/go can result in a write operation to a file controlled by an attacker, with partial control over the file's content. The issue stems from the use of the '#cgo pkg-config:' directive within Go source files. This directive allows command-line arguments to be passed to the Go pkg-config command. An attacker can exploit this by providing a '--log-file' argument, which causes pkg-config to write output to a location specified by the attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.24.5 Go versions prior to 1.23.11 Description: The issue concerns unexpected command execution in untrusted VCS repositories when using the Go toolchain. This can occur when the toolchain is used in directories fetched using VCS tools, such as cloning Git or Mercurial repositories. Recommendations: For versions prior to 1.24.5, update to version 1.24.5 to resolve the issue. For versions prior to 1.23.11, update to version 1.23.11 to resolve the issue. As a temporary workaround, consider avoiding the use of the Go toolchain in untrusted VCS repositories until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Action Pack versions 5.2.0 through 7.0.8.6 Action Pack versions 7.0.8.7 through 7.1.5.0 Action Pack versions 7.1.5.1 through 7.2.2.0 Action Pack versions 7.2.2.1 through 8.0.0.0 **Description** The issue is related to the `content security policy` helper in Action Pack, which may allow an attacker to conduct Cross Site Scripting (XSS) attacks by injecting new directives into the Content-Security-Policy (CSP) headers. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Applications that set CSP headers dynamically from untrusted user input may be vulnerable. **Recommendations** For Action Pack versions 5.2.0 through 7.0.8.6, update to version 7.0.8.7 or later. For Action Pack versions 7.0.8.7 through 7.1.5.0, update to version 7.1.5.1 or later. For Action Pack versions 7.1.5.1 through 7.2.2.0, update to version 7.2.2.1 or later. For Action Pack versions 7.2.2.1 through 8.0.0.0, update to version 8.0.0.1 or later. As a temporary workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

**Name of the Vulnerable Software and Affected Versions** NEC Corporation UNIVERGE IX versions 9.2 through 10.10.21 NEC Corporation UNIVERGE IX versions 10.8 through 10.8.27 NEC Corporation UNIVERGE IX versions 10.9 through 10.9.14 **Description** The issue allows an attacker to hijack the authentication of screens on the device via the management interface. This is a Cross-site request forgery (CSRF) vulnerability, which can be exploited to seize control of the device's authentication. **Recommendations** For versions 9.2 through 10.10.21, update to a version later than 10.10.21 to resolve the issue. For versions 10.8 through 10.8.27, update to a version later than 10.8.27 to resolve the issue. For versions 10.9 through 10.9.14, update to a version later than 10.9.14 to resolve the issue. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NEC Corporation UNIVERGE IX versions Ver9.2 through Ver10.10.21 NEC Corporation UNIVERGE IX versions Ver10.8 through Ver10.8.27 NEC Corporation UNIVERGE IX versions Ver10.9 through Ver10.9.14 NEC Corporation UNIVERGE IX-R/IX-V version Ver1.2.15 and earlier **Description** The issue allows an attacker to inject arbitrary CLI commands to be executed on the device via the management interface. This can be done through the administration interface, enabling the execution of commands on the device. **Recommendations** For NEC Corporation UNIVERGE IX versions Ver9.2 through Ver10.10.21, consider disabling access to the management interface until a patch is available. For NEC Corporation UNIVERGE IX versions Ver10.8 through Ver10.8.27, restrict access to the administration interface to minimize the risk of exploitation. For NEC Corporation UNIVERGE IX versions Ver10.9 through Ver10.9.14, avoid using the management interface for critical operations until the issue is resolved. For NEC Corporation UNIVERGE IX-R/IX-V version Ver1.2.15 and earlier, consider applying configuration changes to limit the attack surface of the device. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GitHub CLI versions 2.6.1 and earlier Description: The issue is related to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details, allowing arbitrary code execution on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In version 2.62.0, the remote username information is being validated before being used. Recommendations: Upgrade to version 2.62.0 to fix the issue. As a temporary workaround, consider validating the remote username information before using it in `ssh` commands. Exercise caution when using custom devcontainer images, prefer default or pre-built devcontainers from trusted sources.

**Name of the Vulnerable Software and Affected Versions** ELECOM WAB-I1750-PS version not specified ELECOM WAB-S1167-PS version not specified **Description** A stack-based buffer overflow issue exists in ELECOM wireless access points. This issue can be triggered by processing a specially crafted HTTP request, potentially allowing arbitrary code execution. **Recommendations** For ELECOM WAB-I1750-PS, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ELECOM WAB-S1167-PS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WordPress plugin Carousel Slider (affected versions not specified) **Description** The Carousel Slider WordPress plugin contains a cross-site request forgery issue in its Carousel image selection feature. When a user is logged in to a WordPress site with the Carousel Slider plugin enabled and accesses a crafted page, it may cause the user to unintentionally alter the site's contents. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WordPress plugin Carousel Slider (affected versions not specified) **Description** The WordPress plugin Carousel Slider provided by Sayful Islam contains a cross-site request forgery issue on the Hero image selection feature. When a user is logged in to the WordPress site with the Carousel Slider plugin enabled and accesses a crafted page, it may cause the user to alter the contents of the WordPress site. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ELECOM wireless access points (affected versions not specified) WAB-I1750-PS (affected versions not specified) WAB-S1167-PS (affected versions not specified) **Description** A cross-site scripting vulnerability exists due to improper processing of input values in `menu.cgi`. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. **Recommendations** For ELECOM wireless access points, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WAB-I1750-PS, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For WAB-S1167-PS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xiexe XSOverlay versions prior to build 647 **Description** The issue allows non-local websites to send malicious commands to the WebSocket API, resulting in arbitrary code execution. **Recommendations** For versions prior to build 647, update to build 647 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebSocket API until a patch is available.