James Kettle

The issue is related to a Server-Side Template Injection (SSTI) vulnerability. It occurs via the `formats` parameter. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue is related to improper validation of input that is passed to the VPN web client services component before being returned to the browser that is in use. This could allow an unauthenticated, remote attacker to conduct browser-based attacks against users of an affected device. An attacker could exploit this by persuading a user to visit a website that is designed to pass malicious requests to a device that is running Cisco ASA Software or Cisco FTD Software and has web services endpoints supporting VPN features enabled. A successful exploit could allow the attacker to reflect malicious input from the affected device to the browser that is in use and conduct browser-based attacks, including cross-site scripting attacks.

The issue involves unauthenticated redirection to a malicious website. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue is related to inconsistent interpretation of HTTP requests when handling `Content-Length` values, potentially allowing a remote attacker to gain privileged access to APIs or poison intermediate caches by sending specially crafted HTTP requests. This could lead to HTTP request smuggling attacks, enabling an attacker to bypass web application firewall protection and conduct XSS attacks. The library is commonly used for local development and tests, and most Perl-based applications are served on top of Nginx or Apache.

Request smuggling can occur for HTTP/1 connections in the affected versions of Varnish Cache and Varnish Enterprise.

Name of the Vulnerable Software and Affected Versions: hyper versions 0.12.0 through 0.13.9 hyper versions 0.14.0 through 0.14.2 Description: The HTTP server code in hyper has a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks". To determine if vulnerable, all these things must be true: using hyper as an HTTP server, using HTTP/1.1, and using a vulnerable HTTP proxy upstream to hyper. If an upstream proxy correctly rejects the illegal transfer-encoding headers, the desync attack cannot succeed. If there is no proxy upstream of hyper, hyper cannot start the desync attack, as the client will repair the headers before forwarding. Recommendations: For hyper versions 0.12.0 through 0.13.9, update to version 0.13.10 or later. For hyper versions 0.14.0 through 0.14.2, update to version 0.14.3 or later. As a temporary workaround, consider rejecting requests that contain a `transfer-encoding` header. Alternatively, ensure any upstream proxy handles `transfer-encoding` correctly.

A cross-site scripting (XSS) issue was discovered, allowing malicious code to be provided by a low-privileged user through the File Upload functionality. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session.

The issue arises from the support for a legacy IIS header that allows users to override the path in the request URL via the `X-Original-URL` or `X-Rewrite-URL` HTTP request header. This can be exploited by a remote attacker to impact the integrity of protected data. The vulnerability affects the `SymfonyComponentHttpFoundationRequest::prepareRequestUri()` function, where `X-Original-URL` and `X REWRITE URL` are used. The exploitation of this issue can lead to web cache poisoning.

The issue is related to a cross-site scripting (XSS) vulnerability. This allows remote attackers to inject arbitrary web script or HTML. The vulnerability is related to "Relative Path Overwrite" in the includes/startup.php file.

The issue allows remote attackers to generate and display arbitrary URLs via crafted `username` and `password` Host header values in the `django.http.HttpRequest.get host` function.

The issue allows attackers to execute arbitrary PHP code via unknown vectors.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting (XSS) attacks.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue allows remote authenticated users to spoof other user accounts by choosing a similar e-mail address, as it does not reject non-ASCII characters in e-mail addresses of new user accounts.