Ghost

يحدث حقن للقوالب من جهة الخادم في صندوق رمال رندرة سمات Twig. إن صندوق الرمل، المصمم لتقييد قوالب السمات التي يرفعها المستخدمون، لا يفرض القيود بشكل كامل، مما يسمح لقالب مصمم خصيصاً بالهروب من صندوق الرمل. يمكن للمستخدم المصرح له الذي يمتلك صلاحية `core:themes:create` رفع سمة خبيثة تؤدي عند رندرتها إلى تنفيذ رمز عشوائي على الخادم بصلاحيات عملية خادم الويب. يسمح هذا بتنفيذ أوامر نظام التشغيل، وقراءة ملفات من جهة الخادم بما في ذلك ملفات التكوين وبيانات اعتماد قاعدة البيانات، وكتابة الملفات، والوصول إلى الخدمات الداخلية.

تتعلق المشكلة بثغرة أمنية تتمثل في «التعديل غير المراقب بشكل صحيح لسمات الكائنات المحددة ديناميكيًا»، مما يسمح بـ«حقن الكائنات» في Drupal core.

A misaligned address was discovered in the robdns commit d76d2e6 at the `/src/zonefile-insertion.c` location.

A misaligned address was discovered at smartdns/src/dns.c in smartdns commit 54b4dc.

A heap overflow was discovered in robdns via the component `block->filename` at `/src/zonefile-insertion.c`.

A misaligned address was discovered at smartdns/src/util.c in smartdns commit 54b4dc.

The issue allows for a timing attack against the `validateToken` function due to a string comparison that stops at the first different character. This enables attackers to guess tokens through brute force, one character at a time, by observing the timing. The search space is reduced to a linear amount of guesses based on the token length times the possible characters.

A heap-based buffer overflow issue was found in ImageMagick's `PushCharPixel()` function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.

A reflected cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML by exploiting the zero parameter.

The issue is related to incorrect access control in the component "/index.php?mod=system&op=orgtree" of dzzoffice, allowing unauthenticated attackers to browse departments and usernames.

A Cross Site Request Forgery issue allows an attacker to gain privileges via the `adduser` function of "index.php".

A flaw was found in the create section from phdr function, which allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, leading to memory corruption and possibly code execution through the binary object's callback function.

The issue arises from a lack of validation on user input data during the login process. This allows parameters passed from the front end to the back end to be controlled, leading to SQL injection.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo delete mask` function in `jocms/apps/mask/mask.php`.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo json check` function in `jocms/apps/mask/inc/getmask.php`.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo json check()` function in `jocms/apps/mask/inc/mask.php`.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo set mask()` function in `jocms/apps/mask/mask.php`.

The issue allows attackers to run arbitrary code via a crafted image upload, exploiting a File Upload vulnerability.

The issue allows attackers to run arbitrary code via the `user name` field of the "/login" API endpoint. This is a Cross Site Scripting (XSS) issue, which means attackers can inject malicious scripts into the website, potentially leading to unauthorized access or control.

The issue allows absolute path traversal due to the unsafe use of the Flask send file function.