Anthony Weems

تسمح هذه الثغرة بتسجيل ملفات عشوائية باسم مستخدم OSV-SCALIBR على النظام المضيف من خلال ثغرة في اجتياز المسار (path traversal) عند استخدام دالة unpack() في OSV-SCALIBR لصور الحاويات. ويشكل هذا مشكلة كبيرة بشكل خاص عند استخدام علامة CLI --remote-image مع صور الحاويات غير الموثوق بها.

The issue arises from the input passed to the `Pdf()` function being shell escaped and then passed to `child process.exec()` during PDF rendering. However, the shell escape fails to properly encode special characters, such as semicolon and curly braces, which can be exploited to achieve command execution.

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use `.metadata.annotations` in an Ingress object to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

The issue is related to insufficient input validation in the JNDI component of the Oracle Java SE and Oracle GraalVM Enterprise Edition. This allows an unauthenticated attacker with network access via multiple protocols to compromise the system, resulting in unauthorized update, insert, or delete access to some accessible data. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security. It can also be exploited through APIs in the specified component.

Name of the Vulnerable Software and Affected Versions: pritunl-client versions prior to 1.0.1116.6 Description: A flaw was found in the software due to a lack of signature verification, leading to sensitive information leakage. Recommendations: For versions prior to 1.0.1116.6, update to version 1.0.1116.6 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: pritunl-client versions prior to 1.0.1116.6 Description: A flaw was found in the software that may allow arbitrary write to a user-specified path, potentially leading to privilege escalation. Recommendations: For versions prior to 1.0.1116.6, update to version 1.0.1116.6 or later to resolve the issue.

The issue is related to a sandbox bypass vulnerability in the Jenkins Script Security Plugin, which is caused by incorrect type conversion. This allows a remote attacker to invoke arbitrary constructors in sandboxed scripts.

The issue is related to a sandbox bypass vulnerability in the Jenkins Pipeline: Groovy Plugin, which is associated with incorrect type conversion. This allows attackers to invoke arbitrary constructors in sandboxed scripts, potentially enabling remote attackers to execute malicious actions.