Lautaro Casanova

تدعم وحدة «Media» تقنية oEmbed، التي تستخدم آليتين لاكتشاف عناوين URL: `providers.json` واكتشاف عناوين URL. يمكن استغلال كود اكتشاف عناوين URL لخداع النظام ودفعه إلى إرسال طلبات غير مصرح بها من جانب الخادم إلى أي عنوان URL عشوائي. ويُعرف هذا بـ «تزوير الطلبات من جانب الخادم» (SSRF)، وهو عيب يتيح للمهاجم إجبار الخادم على إرسال طلبات إلى موقع غير مقصود.

The issue allows an unauthenticated attacker to view all stored server files of all users.

The issue allows an attacker to change the avatar of their profile, enabling the upload of files with HTML extension that can interpret both HTML and JavaScript.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "settings" endpoint and `first name` parameter.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/work" endpoint, specifically using the `job` and `company` parameters.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/relationships" endpoint, specifically using the `first name` and `last name` parameters.

The issue allows an authenticated remote attacker to execute malicious code in the application. This is achieved via CSTI in the "people/add" endpoint, utilizing parameters such as `nickName`, `description`, `lastName`, `middleName`, and `firstName`.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/food" endpoint and `food` parameter.

The issue allows an authenticated remote attacker to execute malicious code in the application via CSTI in the "people:id/introductions" endpoint and `first met additional info` parameter.