Imre Rad

The issue allows arbitrary command execution via specially crafted gitRepo volumes. This can be leveraged by an attacker to execute commands outside of the container's boundary, potentially leading to a container escape. The vulnerability is related to the hooks folder in the target repository. It is estimated that over 3 million results are affected, and the issue has been identified in various Kubernetes versions.

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.13.0 GitHub Enterprise Server version 3.9.15 GitHub Enterprise Server version 3.10.12 GitHub Enterprise Server version 3.11.10 GitHub Enterprise Server version 3.12.4 Description: An authentication bypass vulnerability was present in the GitHub Enterprise Server when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Recommendations: For GitHub Enterprise Server versions prior to 3.13.0, update to version 3.13.0 or later. For GitHub Enterprise Server version 3.9.15, no additional action is required as this version already contains the fix. For GitHub Enterprise Server version 3.10.12, no additional action is required as this version already contains the fix. For GitHub Enterprise Server version 3.11.10, no additional action is required as this version already contains the fix. For GitHub Enterprise Server version 3.12.4, no additional action is required as this version already contains the fix. As a temporary workaround, consider disabling the SAML single sign-on authentication with encrypted assertions feature until a patch is available. Restrict access to the SAML authentication module to minimize the risk of exploitation. Avoid using the encrypted assertions feature in the affected API endpoint until the issue is resolved.

The issue is related to insufficient input validation in the Management Console of GitHub Enterprise Server, allowing an attacker with access to a Management Console user account with the editor role to escalate privileges through a command injection vulnerability. This could enable a remote attacker to execute arbitrary commands and elevate their privileges.

An insufficient entropy issue was identified in GitHub Enterprise Server that allowed an attacker to brute force a user invitation to the Management Console. To exploit this, an attacker would need knowledge that a user invitation was pending. This issue was reported via the GitHub Bug Bounty program.

The issue is related to improper privilege management, allowing users with authorized access to the management console and an editor role to escalate their privileges. This is achieved by making requests to the endpoint used for bootstrapping the instance.

The issue is caused by a buffer overflow in memory, allowing an attacker to execute arbitrary code. This can be exploited by remote attackers, affecting the system. The vulnerability is being actively exploited in the wild.

The issue is related to insufficient access restrictions in the Diagnostics Hub Standard Collector Service of Microsoft Windows operating systems. This can allow an attacker to elevate their privileges. An elevation-of-privilege vulnerability exists, enabling attackers to impact the system.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows (affected versions not specified) Description: The issue is related to insufficient access restrictions in the Diagnostics Hub Standard Collector Service of Microsoft Windows operating systems. This can allow an attacker to elevate their privileges. An elevation-of-privilege vulnerability exists, enabling attackers to impact the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient access restrictions in the Diagnostics Hub Standard Collector Service of Microsoft Windows operating systems. This can be exploited to elevate privileges, allowing an attacker to affect the system.

The issue allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. This can occur when running commands that build untrusted code, such as go get on a malicious package. The problem is caused by the injection of malicious flags through a #cgo directive, enabling argument injection.

The issue is related to an elevation of privilege vulnerability that exists when the Windows Update Orchestrator Service improperly handles file operations. This vulnerability can be exploited by an attacker to elevate their privileges and potentially execute arbitrary code using a specially crafted application.

A directory traversal issue exists in the Android debug bridge, allowing physically proximate attackers with a direct connection to the target device to write to arbitrary system-owned files by using a .. (dot dot) in the tar archive headers.

The issue is related to the improper disclosure of file information by the Windows Modules Installer Service, which can allow an attacker to gain unauthorized access to protected data using a specially crafted application. This can potentially lead to the disclosure of sensitive information and affect the system.

The issue is related to insufficient authentication of data, allowing an attacker to inject executable code into a JAR file without compromising signature verification. This flaw can be exploited by a remote attacker to inject arbitrary code into a trusted JAR, which would be executed inside the sandbox.

The issue is related to the improper sanitization of paths from `jar/` elements in JNLP files. This could allow an attacker to trick a victim into running a specially crafted application, potentially leading to the upload of arbitrary files to arbitrary locations on the user's system. The vulnerability can be exploited by a remote attacker using a specially crafted application to write arbitrary files to the device's file system.

The issue is related to a zip-slip attack during auto-extraction of a JAR file, which could allow an attacker to write files to arbitrary locations. This could potentially be used to replace the main running application and possibly break out of the sandbox. The vulnerability is also associated with incorrect restriction of the directory path name with limited access, allowing a remote attacker to write arbitrary files to the device's file system using a specially crafted file in formats such as .tar, .jar, .war, .cpio, .apk, .rar, or .7z.

The issue is related to the `do ed script` function in the GNU Patch utility, which fails to neutralize special elements used in operating system commands. This can be exploited by opening a crafted patch file containing an ed style diff payload with shell metacharacters, potentially allowing an attacker to access confidential information and execute arbitrary commands.

The issue concerns an incomplete synchronizer pattern implementation, which was intended as a remediation measure. This incompleteness leads to a CSRF issue in the add vhost.php file, allowing an attacker to add or delete vhosts without the owner's consent.

The issue is related to an implementation flaw in the HTTP request parsing logic. By sending a crafted `multipart/form-data` HTTP request, an attacker could exploit this to force the service into an infinite loop, exhausting available CPU resources and taking the service down.

The issue concerns a denial of service (memory exhaustion) that can be exploited remotely without authentication, potentially affecting other services running on the targeted host. This is due to a problem in the read packet function.