Apache Shiro could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability when "form" authentication is used. An attacker could exploit this vulnerability using a specially crafted URL to redirect a victim to arbitrary Web sites.

Node.js could allow a remote attacker to bypass security restrictions, caused by the circumvention of integrity checks by the policy feature. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Incorrect cipher key & IV length processing

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems.

Google Android could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Android runtime library. By using a specially-crafted payload, an attacker could exploit this vulnerability to execute arbitrary code in the context of an unprivileged process.