Alemmi

يمكن للمهاجم صياغة رابط URL يؤدي عند زيارته من قبل مستخدم مصرح له إلى التلاعب بالخلفية (backend) لإعادة توجيه المستخدم إلى أي موقع. تحدث هذه المشكلة فقط إذا كانت إعدادات المنطقة الزمنية (locale) للضحية في Icinga Web مختلفة عن `en US`.

An issue in the way the system loads theme translation files allows an authenticated Administrator to execute arbitrary code on the server by using a crafted theme.

Authenticated administrators can achieve remote code execution by abusing the theme translation file loading process. This occurs when an attacker with administrator privileges uploads a specially crafted theme containing malicious translation files, allowing the execution of arbitrary code on the server.

تسمح ثغرة أمنية في Icinga Web 2 للمهاجم بإنشاء عنوان URL، والذي بمجرد زيارة أي مستخدم له، يتيح تضمين جافا سكريبت تعسفي في Icinga Web ويسمح للمهاجم بالتصرف نيابة عن هذا المستخدم.

The issue affects the GLPI Agent, a generic management agent, when running the remoteinventory task against a Unix platform using the ssh command. An administrator user on the remote system can inject a command into a specific workflow that the agent runs with its privileges. If the agent is running with administration privileges, a malicious user could gain high privileges on the computer running the GLPI Agent. Additionally, a malicious user could disclose all remote accesses configured for the remoteinventory task.

The issue is related to insufficient cleaning of user data in the GLPI inventory endpoint, allowing an unauthenticated user to send a specially crafted request to the vulnerable application and execute arbitrary SQL commands in the application's database. This can enable a remote attacker to read, delete, or modify data in the database and gain full control over the vulnerable application. The GLPI inventory endpoint requires no authentication by default.

The issue is related to insufficient user data sanitization on search pages, allowing an attacker to craft a malicious link that can exploit a reflected XSS when opened by an authenticated user. This can lead to the execution of arbitrary HTML and script code in the user's browser, potentially allowing a remote attacker to steal confidential information, modify the webpage's appearance, or conduct phishing and drive-by download attacks.

The issue allows an attacker to inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Although the content security policy prevents loading scripts from most locations, `www.google-analytics.com` is allowed, which can be exploited using Google Tag Manager to inject arbitrary JavaScript and execute it on page load. Depending on the instance configuration, the attacker may not need authentication to create or edit notes.