Khaled Nassar

يمكن للمهاجمين المصادق عليهم تجاوز إجراءات الحماية من تزوير الطلبات من جانب الخادم (SSRF) من خلال استغلال عمليات الاسترداد عبر HTTP في مسارات كود الترحيل ورمز الصورة الرمزية لـ OAuth. تحدث هذه المشكلة لأن التطبيق يستخدم دالة `http.Get` الافتراضية في لغة Go دون استخدام `DialContext` مخصص. يمكن للمهاجمين توفير عناوين URL عشوائية من خلال عناوين URL لتنزيل أصول الإصدار، أو عناوين URL لتصحيحات طلبات السحب (pull-request)، أو نقاط نهاية OAuth avatar للوصول إلى الخدمات الداخلية، أو نقاط نهاية بيانات تعريف مثيلات السحابة، أو قراءة الملفات المحلية، بما في ذلك تكوينات التطبيق التي تحتوي على بيانات اعتماد قاعدة البيانات وأسرار التوقيع. يمكن حفظ البيانات المسربة كأصول إصدار الترحيل لاسترجاعها لاحقًا.

تتعلق المشكلة بالتحييد غير السليم لعلامات HTML المرتبطة بالنصوص البرمجية في صفحة ويب، والمعروفة أيضًا باسم «XSS الأساسي». وهذا نوع من الثغرات الأمنية التي تحدث عندما يفشل التطبيق في معالجة علامات HTML المتعلقة بالنصوص البرمجية بشكل صحيح، مما يسمح للمهاجم بإدخال نصوص برمجية ضارة في صفحة الويب.

تم الإبلاغ عن ثغرة أمنية تتعلق بحقن الأوامر، مما قد يسمح للمهاجمين عن بُعد بتنفيذ أوامر عشوائية.

This issue allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. The specific flaw exists within the handling of firmware updates, resulting from the use of an insecure protocol to deliver updates. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. No authentication is required to exploit this issue.

The issue is related to the tarfile.extractall method, which lacks proper validation of a user-supplied path prior to using it in file operations. This allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices without requiring authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.

The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel. It is associated with the failure to neutralize special elements. Exploitation of this issue may allow an attacker to elevate their privileges.

This issue allows network-adjacent attackers to compromise transport security on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `CURLOPT SSL VERIFYHOST` setting, resulting from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other issues to execute code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations. The flaw exists within the handling of OCPP messages due to the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this to execute code in the context of root.

The issue is related to a stack-based buffer overflow vulnerability in the handling of base64-encoded data within WebSocket messages. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 chargers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of base64-encoded data within WebSocket messages, resulting from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer.

The issue is related to the use of an unreliable path search in the Windows kernel, allowing an attacker to elevate their privileges. This can affect the system, potentially leading to unauthorized access or control. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided.

The vulnerability is related to insufficient input validation in the Windows Themes component, allowing remote attackers to execute arbitrary code on the system. This can occur when a user opens a malicious .THEME file. The issue has been exploited in real-world incidents, with proof-of-concept exploit code published. A successful exploit could grant attackers complete control over the victim's system, allowing them to install malware, steal sensitive data, or launch further attacks within the network.