Aaron Portnoy

اسم البرنامج المعرض للخطر والإصدارات المتأثرة TheLibrarians (الإصدارات المتأثرة غير محددة) الوصف تسمح أداة web fetch الموجودة في TheLibrarians بالحصول على محتوى واجهة Adminer، مما يتيح الوصول غير المصرح به إلى النظام الخلفي الداخلي لـ TheLibrarians. وهذا يتيح للمهاجم تسجيل الدخول إلى النظام الخلفي. التوصيات في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

يعاني برنامج TheLibrarian من مشكلة تتعلق بمسح المنافذ الداخلية ناجمة عن أداة `web fetch`. تتيح هذه الأداة حدوث سلوك من نوع تزوير الطلبات من جانب الخادم (SSRF)، مما يسمح بإرسال طلبات GET إلى عناوين IP وخدمات داخلية. يمكن استغلال هذه الميزة لمسح بيئة Hertzner السحابية التي يستخدمها TheLibrarian. أداة `web fetch` هي المكون المتورط بشكل مباشر في هذه المشكلة.

The issue is a stack-based buffer overflow in the OmniInet.exe component, which is part of the Application Recovery Manager. This occurs when the MSG PROTOCOL command is used with long arguments, allowing remote attackers to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Microsoft DirectX versions 7.0 through 9.0c Description: The issue arises from the QuickTime Movie Parser Filter in quartz.dll, which fails to properly validate size fields in QuickTime media files. This allows remote attackers to execute arbitrary code via a crafted file. Recommendations: For Microsoft DirectX versions 7.0 through 9.0c, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the QuickTime Movie Parser Filter in DirectShow to minimize the risk of arbitrary code execution.

A heap-based buffer overflow in the VNnc Codec allows remote attackers to execute arbitrary code via a crafted web page or video file.

A heap-based buffer overflow in the VNnc Codec allows remote attackers to execute arbitrary code via a crafted web page or video file.

A remote code execution issue exists in the way Microsoft Office handles specially crafted Rich Text Format (RTF) files. This could allow remote code execution if a user opens a specially crafted RTF file in Word, or reads or previews a specially crafted e-mail sent in the RTF format. An attacker who successfully exploits this issue could take control of an affected system in the context of the currently logged-on user, potentially installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

The issue is related to a heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service, allowing remote attackers to read memory contents and execute arbitrary code via a crafted RPC call. This is due to improper processing of parameters to string APIs.

The issue is related to input validation errors, which could allow remote attackers to execute arbitrary code via unknown vectors.

A heap-based buffer overflow issue exists in the SendChannelData function within wfica.ocx. This allows remote malicious websites to execute arbitrary code by manipulating the `DataSize` parameter to be less than the length of the `Data` buffer.