Jakaba

Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code execution (RCE). Exploitation involved overwriting `/etc/ld.so.preload` to load a malicious shared library, escalating from arbitrary file write to remote code execution. Over 1,000 instances were found to be exposed. The issue occurs because Ollama does not validate the format of the digest (SHA256 with 64 hexadecimal digits) when obtaining the model path, mishandling cases with fewer or more than 64 digits, or when the path begins with a `../` substring.

A memory corruption vulnerability in Fluent Bit's embedded HTTP server allows an unauthenticated attacker to potentially execute arbitrary code, cause a denial of service, or disclose sensitive information. The issue is related to a heap buffer overflow when parsing trace requests. With over 13 billion downloads, Fluent Bit is widely used in major cloud platforms and by tech giants, making this vulnerability particularly concerning. While creating a reliable exploit for remote code execution may be challenging, a proof of concept for denial of service is already publicly available.

Name of the Vulnerable Software and Affected Versions: Apache HugeGraph-Server versions 1.0.0 through 1.3.0 Description: The issue affects Apache HugeGraph-Server, allowing unauthenticated remote code execution and server takeover. This flaw can be exploited by attackers to bypass sandbox restrictions, leading to remote code execution. The vulnerability has been identified in HugeGraph-Server versions 1.0.0 – 1.3.0. It is recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. The vulnerability is being actively exploited, and users are advised to take immediate action to prevent exploitation. Recommendations: Upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. As a temporary workaround, consider disabling the vulnerable `groovy` injection functionality until a patch is available. Restrict access to the vulnerable `gremlin` endpoint to minimize the risk of exploitation. Avoid using the `groovy` parameter in the affected API endpoint until the issue is resolved.

A critical issue affects the processing of the file /index.php?menu=asterisk cli of the component Asterisk-Cli. The manipulation of the argument `Command` leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

The issue in XWiki Platform stems from a lack of input validation within the database search functionality. This allows a non-authenticated attacker to achieve remote code execution. The database search is accessible by default to all users, meaning any visitor to a public wiki or user of a closed wiki could potentially exploit this issue, impacting the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability allows execution of arbitrary code through the search text. The API endpoint involved is `/xwiki/bin/get/Main/DatabaseSearch`. The vulnerable parameter is `text`.

The issue concerns a high-performance, distributed RPC framework. When a TCP server is set up using the Netty framework and the Hessian serialization mechanism, attackers may be able to connect to the server and provide malicious serialized objects. Once deserialized, these objects can force the server to execute arbitrary code, potentially allowing attackers to take control of the machine the server is running on through remote code execution.

The vulnerability is related to the improper neutralization of special elements used in a template engine, allowing a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. This issue has been exploited in real-world attacks, with threat actors targeting older versions of the HTTP File Server to drop malware and cryptocurrency mining software. The estimated number of potentially affected devices worldwide is not explicitly stated, but it is known that over 89,700 services are found to be vulnerable.

The built-in SSH server allows argument injection in `internal/ssh/ssh.go`, which can lead to remote code execution. Authenticated attackers with at least one SSH key can exploit this by opening an SSH connection and sending a malicious `--split-string` request via the `env` command if the built-in SSH server is enabled (configured as `[server] START SSH SERVER = true`). This allows the attacker to execute arbitrary commands with the privileges of the user specified by `RUN USER` in the configuration, potentially enabling access to or alteration of any user's code on the instance. Windows installations are not affected. Approximately 7,300 to 8,300 exposed instances have been identified.