** DISPUTED ** Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. (Local filesystem access is needed by the attacker.) NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access. In some cases, even after a self-initiated file deletion, an attacker can still recover the file if it was previously replied to in a conversation. Cached attachments are not effectively cleared. ** DISPUTED ** Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. NOTE: the vendor's position is that 'the access level granted is in line with business requirement.' ** DISPUTED ** Incorrect access control in Temenos T24 Release 20 allows attackers to gain unauthorized access to sensitive information via a crafted POST request to HELPTEXT.MAINMENU.

NOTE: the vendor's position is that 'Auto-fill on page load' is not enabled by default.

** DISPUTED ** Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an hosting provider when is visited.

Uri techsmith relay