Threats tagged 'ghsa-cwv8-gh9g-g9wh'

The Progress Software Fiddler Download and Setup Skill for Linux, macOS, and Windows lacks integrity verification of downloaded components. This vulnerability allows an attacker to compromise or influence a release component, potentially leading to execution of attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable location and installs it with administrator privileges, which may enable code execution with root privileges after user approval. Additionally, a local process could replace the staged macOS package while the skill awaits approval.