users(), wifiNetworks() fixed parsing (macOS Seguoia)

docs/security.html

@@ -44,10 +44,27 @@
             <div class="col-12 sectionheader">
               <div class="title">Security Advisories</div>
               <div class="text">
+                <h2>SSID Command Injection Vulnerability</h2>
+                <p><span class="bold">Affected versions:</span>
+                  &lt; 5.23.7<br>
+                  <span class="bold">Date:</span> 2024-11-11<br>
+                  <span class="bold">CVE indentifier</span> CVE-2024-56334
+                </p>
+
+                <h4>Impact</h4>
+                <p>We had an issue that there was a possibility to perform a potential command injection possibility by crafting detected SSIDs in <span class="code">networkInterfaces()</span> on windows machines.</p>
+
+                <h4>Patch</h4>
+                <p>Problem was fixed with parameter checking. If you are using version 5, please upgrade to version >= 5.23.7.</p>
+                <hr>
+                <br>
+
                 <h2>Passing User Paramters to Systeminformation</h2>
                 <p>For most of the applications that are using <span class="code">systeminformation</span>, there is no reason to worry. <span class="bold">But be aware!</span> If you are using <span class="code">inetLatency()</span>, <span class="code">inetChecksite()</span>, <span class="code">services()</span>, <span class="code">processLoad()</span>, <span class="code">versions()</span> with arbitrary untrusted user input, you should pay extra attention! We are doing a lot of input sanitation for those functions inside this package but we cannot handle all cases!</p>
                 <p class="warning">This can lead to serious impact on your servers!</p>
                 <p>We highly recommend to always upgrade to the latest version of our package. We maintain security updates for version 5 AND also version 4. For version 4 you can install latest version by placing <span class="code">"systeminformation": "^4"</span> in your package.json (dependencies) and run <span class="code">npm install</span></p>
+                <hr>
+                <br>
 
                 <h2>SSID Command Injection Vulnerability</h2>
                 <p><span class="bold">Affected versions:</span>