Nhienit

تسمح إجراءات المصادقة الضعيفة لمهاجم مخول برفع مستوى الامتيازات محليًّا.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات Apache Airflow Providers Snowflake الأقدم من 6.4.0 الوصف: تتعلق المشكلة بخلل في عملية تنقية العناصر الخاصة في خطة مختلفة، والمعروفة أيضًا باسم ثغرة حقن العناصر الخاصة. تؤثر هذه الثغرة على `CopyFromExternalStageToSnowflakeOperator`، حيث تمت إضافة عملية تنقية المعلمات `table` و`stage` لمنع حقن SQL. التوصيات: بالنسبة للإصدارات الأقدم من 6.4.0، قم بالتحديث إلى الإصدار 6.4.0 الذي يعالج المشكلة. كحل بديل مؤقت، ضع في اعتبارك إضافة عملية تنقية للمعلمتين `table` و`stage` في `CopyFromExternalStageToSnowflakeOperator` لمنع حقن SQL.

تسمح هذه الثغرة للمهاجمين المصادق عليهم الذين يتمتعون بحقوق وصول على مستوى المسؤول أو أعلى بتنفيذ حقن SQL عام عبر المعلمة `columns`، وذلك بسبب عدم كفاية الهروب من الأحرف الخاصة وعدم التحضير الكافي في استعلام SQL الحالي. وهذا يتيح للمهاجمين إرفاق استعلامات SQL إضافية لاستخراج معلومات حساسة من قاعدة البيانات.

The issue is related to SQL Injection via the `page id` parameter of the `wpjobportal deactivate()` function due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Name of the Vulnerable Software and Affected Versions: Apache Airflow version 2.10.0 Description: The issue allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. This is related to the example DAG `example inlet event extra.py` shipped with Apache Airflow. It is recommended to review DAGs based on this example and to avoid exposing example DAGs in deployments. Recommendations: For Apache Airflow version 2.10.0, upgrade to version 2.10.1 or later to resolve the issue. If you must expose the example DAGs, consider upgrading as the primary mitigation measure. As a temporary workaround, consider restricting access to the example DAGs until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to the file auditing configuration, where the lack of protection of the SQL query structure allows for authenticated SQL injection. This can enable a remote attacker to execute custom queries and gain access to database table records. Recommendations: For versions below 8110, update to a version 8110 or later to resolve the authenticated SQL injection issue in the file auditing configuration. As a temporary workaround, consider restricting access to the file auditing configuration to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to a lack of protection of the SQL query structure in the Windows Active Directory management and reporting tool. This can allow a remote attacker to execute custom queries and gain access to database table records. The vulnerability is associated with an authenticated SQL Injection in the attack surface analyzer's dashboard. Recommendations: For Zohocorp ManageEngine ADAudit Plus versions below 8110, update to a version 8110 or later to resolve the issue. As a temporary workaround, consider restricting access to the attack surface analyzer's dashboard until a patch is available. Avoid using the vulnerable SQL query structure in the dashboard until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

The issue allows SQL Injection in the lockout history option. Note that non-admin users cannot exploit this vulnerability.

The issue allows SQL injection while getting file server details.

The issue is related to SQL Injection in the report export option.

The issue allows SQL Injection in the aggregate report feature. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue allows for XSS attacks. A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data.