Brendan Scarvell

يمكن للمهاجمين المصادق عليهم تنفيذ أوامر عشوائية بصفة الجذر عن طريق إدخال أحرف خاصة بـ shell في معلمة JSON `username`. يحدث هذا لأن الدالة `dalStorage addUserAccount()` تقوم بربط المدخلات التي يقدمها المستخدم بشكل غير آمن في سلسلة أوامر shell يتم تمريرها إلى `rut doSystemAction()` دون تنقية مناسبة، مما يؤدي إلى تنفيذ أوامر كاملة على مستوى الجذر في نظام التشغيل.

يوجد ثغرة في واجهة الإدارة عبر الويب تسمح بتجاوز المصادقة، وذلك بسبب استخدام مفتاح AES-256 مبرمج بشكل ثابت لتشفير ملفات تعريف الارتباط الخاصة بالجلسة. يمكن لمهاجم غير مصدق عليه استخدام هذا المفتاح المشترك لتزوير ملف تعريف ارتباط مشفر صالح للجلسة والحصول على السيطرة الإدارية الكاملة على الواجهة، شريطة أن تكون جلسة عمل مسؤول شرعي نشطة.

The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.

The issue allows command line arguments to be injected during Firefox invocation as a shell handler for certain unsupported file types. This requires Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third-party application that insufficiently sanitizes URL data. In such a situation, clicking a link in the third-party application could be used to retrieve and execute files whose location was supplied through command line arguments. This issue only affects Windows operating systems when Firefox is configured as the default handler for non-default file types.

Name of the Vulnerable Software and Affected Versions: Electron versions 1.7 up to 1.7.12 Electron versions 1.8 up to 1.8.3 Electron versions 2.0.0 up to 2.0.0-beta.3 Description: The issue is related to an improper handling of values in Webviews, which can result in remote code execution. This can be exploited via an app that allows execution of 3rd party code, disallows node integration, and has not specified if webview is enabled or disabled. The application must also meet specific conditions, including running on affected Electron versions, allowing execution of arbitrary remote code, disabling Node.js integration, and not explicitly declaring webviewTag as false. Recommendations: For Electron versions 1.7 up to 1.7.12, update to version 1.7.13 or later. For Electron versions 1.8 up to 1.8.3, update to version 1.8.4 or later. For Electron versions 2.0.0 up to 2.0.0-beta.3, update to version 2.0.0-beta.5 or later. If an update is not possible, mitigate the vulnerability by using the provided code to disable node integration and webviewTag in webPreferences, and prevent new-window events from overriding event.newGuest without using the supplied options tag. Additionally, consider preventing the attachment of webviews if they are not used.