Chris Davis

Name of the Vulnerable Software and Affected Versions: Froala WYSIWYG Editor version 3.2.6-1 Description: The issue is related to a namespace confusion during parsing, which leads to a cross-site scripting (XSS) problem. Recommendations: For Froala WYSIWYG Editor version 3.2.6-1, update to a version that fixes the namespace confusion issue to prevent XSS attacks.

Name of the Vulnerable Software and Affected Versions: Cloud Manager versions prior to 3.9.4 Description: The issue allows a remote attacker to overwrite arbitrary system files. Recommendations: For Cloud Manager versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Cloud Manager versions prior to 3.9.4 Description: The issue is related to an insecure Cross-Origin Resource Sharing (CORS) policy. This could allow a remote attacker to interact with Cloud Manager. CORS is a security feature that restricts web pages from making requests to a different origin (domain, protocol, or port) than the one the web page was loaded from. An insecure CORS policy can allow malicious scripts to make unauthorized requests on behalf of the user. Recommendations: For Cloud Manager versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue. As a temporary workaround, consider restricting access to Cloud Manager to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Cloud Manager versions prior to 3.9.4 Description: The issue allows a remote attacker to cause a Denial of Service (DoS). Recommendations: For Cloud Manager versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: R versions prior to 4.0.3 Description: The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the `install.packages()` function from the interpreter. Recommendations: Update to version 4.0.3 to resolve the issue. As a temporary workaround, consider restricting the use of the `install.packages()` function and the R CMD install cli command until the update is applied.

The issue is related to improper session management, where user sessions are not revoked upon logout.

The issue allows a low-privileged user to escalate privileges to administrative permissions through stored XSS. Additionally, unauthenticated attackers can exploit reflected, DOM-based XSS to phish unauthenticated Immuta users, potentially stealing credentials or forcing actions on authenticated users.

The issue is related to insecure permissions, which can lead to user account takeover.

The issue allows attackers to inject arbitrary HTML content into the application by supplying malicious project names. This could be used to redirect users to a phishing website in an attempt to steal credentials.

The issue concerns a lack of authorization enforcement in the affected devices. This can be exploited from within the intranet and potentially combined with other vulnerabilities to achieve remote exploitation.

The issue allows for a U-Boot interrupt, which can result in local root access.

The issue concerns an undocumented SSH user account in Winston devices, which allows access from bastion hosts. This account is not mentioned in device documentation and its existence is not disclosed to users.

The issue allows for command injection via the API.

The API on Winston devices is vulnerable to CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application.

A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script when configured in classic editing mode. The vulnerability is in the core parser and allows arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs.

The issue is related to systemic CSRF, which affects the software's ability to prevent cross-site request forgery attacks.

The issue allows for cross-site scripting (XSS) attacks, which can force arbitrary actions on behalf of other users, including administrators. This means an attacker could potentially perform actions as if they were another user, without that user's knowledge or consent.

The issue allows low-privilege authenticated users to perform SQL injection, enabling them to enumerate the database.

The issue allows for Local File Inclusion, enabling the inclusion and execution of arbitrary PHP code within the application.

The issue is related to a client-side template injection in SecureAuth.aspx, which allows for script execution similar to XSS. This enables potential attackers to execute scripts on the client-side.