Markus Vervier

ثغرة في خادم البروكسي تسمح للمهاجمين عن بُعد بتنفيذ تعليمات برمجية عشوائية من خلال إعادة كتابة البايت كود. تحدث المشكلة لأن نقطة النهاية `POST /guardrails/test custom code` تُنفذ لغة Python التي يقدمها المستخدم داخل بيئة عزل مخصصة يمكن التحايل عليها باستخدام تقنيات على مستوى البايت كود. وهذا يسمح بتنفيذ كود ضار في عملية الوكيل، التي تُنفذ عادةً بامتيازات الجذر في صورة Docker القياسية. في الإعدادات الافتراضية، يتطلب الوصول إلى نقطة النهاية هذه بيانات اعتماد مسؤول الوكيل.

يؤدي التعطيل غير السليم للعناصر الخاصة المستخدمة في أحد الأوامر إلى حدوث ثغرة حقن الأوامر في GitHub Copilot وVisual Studio، مما يسمح لمهاجم غير مصرح له بتنفيذ التعليمات البرمجية محليًّا. ويمكن تحقيق ذلك من خلال حقن المطالبة (prompt injection)، حيث يخفي المهاجم تعليمات ضارة داخل تعليق في المستودع أو ملف README أو وصف طلب السحب (PR). وقد يتم خداع المساعد الذكي لتعديل ملف `.vscode/settings.json` لتمكين وضع الموافقة التلقائية، مما يسمح للوكيل بتنفيذ أوامر bash تعسفية في المحطة الطرفية دون الحاجة إلى تأكيد بشري.

The issue is related to the gitattributes mechanism in Git, which allows defining attributes for paths. When parsing gitattributes, multiple integer overflows can occur due to a huge number of path patterns, a huge number of attributes for a single pattern, or huge declared attribute names. These overflows can be triggered via a crafted `.gitattributes` file, potentially leading to arbitrary heap reads and writes, and may result in remote code execution. The failure mode depends on whether the file exists in the working tree, the index, or both.

The issue concerns arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim, allowing the attacker to fully control the user account. Wire-desktop clients connected to a vulnerable wire-webapp version are also vulnerable to this attack.

The issue is related to the use of a weak seed for random number generation, which leads to predictable AES keys used in NFC tags for local authorization of users. This may result in the total loss of trustworthiness of the installation.

Name of the Vulnerable Software and Affected Versions: Avira AntiVir Engine versions prior to 8.2.12.58 Description: A Denial of Service vulnerability exists due to an infinite loop in an unspecified function within the PDF Scanner Engine. Recommendations: For Avira AntiVir Engine versions prior to 8.2.12.58, update to version 8.2.12.58 or later to resolve the issue.

The issue is caused by a buffer overflow in the Texture Client Handler component of the Firefox browser, allowing a remote attacker to potentially cause a denial of service using a specially crafted web page. It can also lead to a crash and out-of-bounds read when a texture client's buffer is freed while still in use during graphic operations, potentially allowing the reading of memory from freed buffers.

The issue allows remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled. This is mishandled in the `FaxModem::writeECMData()` function in the faxd/CopyQuality.c++ file.

The issue allows attackers to hide data in the Graphical User Interface (GUI) view and create arbitrary entries to a certain extent by not properly escaping data before writing it into a Comma Separated Values (CSV) file. Special characters such as `"`, `,` and `r` are not escaped and can be used to add new entries to the log.

The issue allows FTP bounce scans to be performed by default, which can be exploited using commands like "nmap -b". This enables scans to be conducted via the FTP server.

The issue is caused by an integer overflow in the proto.c file of libotr, which can lead to memory corruption and application crash, or potentially allow execution of arbitrary code. This occurs when a series of large OTR messages are sent, triggering a heap-based buffer overflow. The issue is specific to 64-bit platforms.

The issue is related to a double free vulnerability in the writeDataError function within the ElasticSearch plugin (omelasticsearch) of rsyslog. This vulnerability can be exploited by remote attackers when the errorfile is set to local logging, allowing them to cause a denial of service (crash) and potentially execute arbitrary code via a crafted JSON response.

A double free issue in the PyPAM conv function in PAMmodule.c allows remote attackers to cause a denial of service, potentially leading to application crashes, or possibly execute arbitrary code. This can be achieved by including a NULL byte in a password string.