Josh Bressers

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

The issue arises from how FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. Specifically, it uses the `MD5File()` function, which takes a `pathname` as an argument and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.

Name of the Vulnerable Software and Affected Versions: Squirrelmail version 4.0 Description: The issue concerns the use of the outdated MD5 hash algorithm for passwords. Recommendations: For Squirrelmail version 4.0, consider updating the password hashing mechanism to a more secure algorithm as a permanent fix. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns multiple cross-site scripting (XSS) flaws. Cross-site scripting is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control of user sessions.

The issue allows attackers to spoof syslog messages via newline injection attacks.

An issue exists due to the way cookies are handled.

The issue allows a local attacker to conduct symlink attacks because it operates on full file system objects path names.

The issue is related to a cross-site scripting (XSS) vulnerability in error message contents. This type of vulnerability allows attackers to inject malicious scripts into content from otherwise trusted websites.

The issue arises from the way addslashes are used in SQL string escapes, potentially leading to unspecified security consequences.

The issue is related to cross-site scripting (XSS).

The issue allows local users to gain privileges through unspecified Trojan horse code in the current working directory due to an untrusted search path vulnerability in x11perfcomp.

The issue prevents Firefox plugins from determining if they should run in Private Browsing mode, allowing remote attackers to bypass intended access restrictions. This could be demonstrated using Flash, where the `NPNVprivateModeBool` variable settings are not properly provided.

The issue concerns a problem with privilege checking in libgssapi and libgssglue, which can be exploited locally. This can lead to the execution of arbitrary code via the `GSSAPI MECH CONF` environment variable. For example, this can be demonstrated using `mount.nfs`. The exploitation of this issue may result in a breach of confidentiality, integrity, and availability of protected information.

The issue concerns the generate admin password function, which uses time and PID values for seeding a random number generator. This makes it easier for local users to determine admin passwords via a brute-force attack.

The issue is related to a heap-based buffer overflow in the `Lookup MarkMarkPos` function in the HarfBuzz module (`harfbuzz-gpos.c`), which can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

The issue concerns multiple vulnerabilities in the libmodplug package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, a stack-based buffer overflow in the `CSoundFile::ReadS3M` function allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.

The issue is related to multiple vulnerabilities in the libmodplug package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, an off-by-one error in the `CSoundFile::ReadDSM` function in `src/load dms.cpp` allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.

The issue involves multiple race conditions in the mount.cifs and umount.cifs programs, allowing local users to cause a denial of service via a SIGKILL signal during a specific time window when the /etc/mtab~ file exists. This can lead to a mounting outage. The vulnerability can be exploited remotely, potentially disrupting confidentiality, integrity, and availability of protected information.

The issue allows context-dependent attackers to cause a denial of service or trigger a buffer overflow by providing an arbitrary value for a function argument. This is related to multiple files, including ext/curl/interface.c, ext/date/lib/parse date.c, ext/date/lib/parse iso intervals.c, ext/date/lib/parse tz.c, ext/date/lib/timelib.c, ext/pdo odbc/pdo odbc.c, ext/reflection/php reflection.c, ext/soap/php sdl.c, ext/xmlrpc/libxmlrpc/base64.c, TSRM/tsrm win32.c, and the strtotime function.

The issue involves multiple vulnerabilities in the gimp packages of CentOS and Red Hat Enterprise Linux operating systems. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information.