Dawid Golunski

The issue allows Remote Code Execution (RCE) on Windows systems when Git LFS operates on a malicious repository with a `git.bat` or `git.exe` file in the current directory. This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. The problem does not affect Unix systems.

The issue allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header. This can be demonstrated by a password reset request.

The issue allows remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request. This is related to problematic use of the `SERVER NAME` variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period, (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.

The issue allows post-authentication remote code execution via a mishandled sendmail.cf file in a popen call. This can be exploited to execute arbitrary shell commands on the remote server. The problem lies in the Deliver SendMail.class.php file, specifically in the initStream function, which incorrectly uses escapeshellcmd() to sanitize the sendmail command. The `sendmail` command line, particularly the `-f$envelopefrom` part, is vulnerable to injection of arbitrary command parameters due to the lack of whitespace escaping. If the target server uses sendmail and SquirrelMail is configured to use it, an attacker can trick sendmail into using a malicious sendmail.cf file, leading to arbitrary command execution. This can be achieved by uploading a sendmail.cf file as an email attachment and then injecting the filename with the `-C` option in the "Options > Personal Informations > Email Address" setting.

The issue allows remote attackers to spoof their IP via the `CLIENT-IP HTTP` header. This is due to a problem in the `clientIp` function.

The issue allows remote attackers to potentially execute arbitrary code by passing extra parameters to the mail command. This is achieved through a crafted e-mail address containing a backslash double quote (") in the `setFrom` function of the Sendmail adapter in the zend-mail component.

The issue allows remote attackers to potentially execute arbitrary code by passing extra parameters to the mail command. This can be achieved by including a (backslash double quote) in a crafted e-mail address within the From, ReturnPath, or Sender header.

The issue allows remote attackers to execute arbitrary code. This can be achieved by passing extra parameters to the mail command via a crafted Sender property in PHPMailer. There is a potential for remote code execution in Wordpress 4.6.

The issue is related to a symlink attack on a logfile in /var/log/postgresql, allowing local users to gain root privileges. The vulnerability is caused by incorrect link resolution before accessing a file, which can be exploited to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity.

The issue allows remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. This is due to an incomplete fix for a previous issue.

The issue allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. This can be leveraged by remote attackers.

The issue allows local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

The issue allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files when using file-based logging. It can also be exploited by a high-privileged attacker with network access via multiple protocols to compromise the MySQL Server, resulting in unauthorized ability to cause a hang or frequently repeatable crash of the MySQL Server.

The issue is related to weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

The issue allows local users with access to the Tomcat account to gain root privileges via a symlink attack on the Catalina log file. This can be demonstrated by an attack on the /var/log/tomcat7/catalina.out file.

The media-file upload feature in vBulletin allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via a crafted URL that results in a Redirection HTTP status code. This issue can be exploited by sending a specially crafted URL.

The issue is related to an XML External Entity (XXE) problem in the Office Open XML (OOXML) feature, allowing remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference.

The issue allows local users to create arbitrary configurations and bypass certain protection mechanisms by setting `general log file` to a my.cnf configuration. This can be leveraged to execute arbitrary code with root privileges by setting `malloc lib`. The vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash of MySQL Server.

The issue is related to errors in security settings, allowing remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. This can be exploited by an attacker to modify files. The estimated number of potentially affected devices is not provided.

The issue allows local users to gain privileges through the `perl startup` argument when Exim is installed setuid root.