Or Peles

An issue exists where the management API accepts custom plugins via an HTTP URL through the 'POST /api/plugins' endpoint when management authentication is disabled (default setting `governance.auth config.is enabled=false`). The shared-object loader downloads the remote object, writes it as a temporary `.so` file, and passes it to Go's `plugin.Open` function, which then executes the plugin's optional `Init()` function with the privileges of the Bifrost process user. On dynamically linked builds, this leads to unauthenticated remote code execution. On statically linked Docker images, the process results in server-side request forgery (SSRF), which is a vulnerability where the server is coerced into making unauthorized requests to internal or external resources. Successful remote code execution requires the plugin to match the host's Go version, operating system, CPU architecture, and linkage configuration.

برنامج mcp-remote، وهو خادم وكيل محلي يتيح لعملاء MCP التفاعل مع الخوادم البعيدة، معرض لخطر حقن أوامر نظام التشغيل. تحدث هذه المشكلة أثناء عملية المصافحة (handshake) الخاصة بـ OAuth عندما يطلب الخادم الوكيل بيانات وصفية من خادم بعيد. يمكن لخادم ضار تقديم عنوان URL استجابة `authorization endpoint` مُعدّ خصيصًا يحتوي على أوامر نظام. وبسبب عدم إجراء التنقية بشكل صحيح، يحاول mcp-remote فتح عنوان URL هذا مباشرةً عبر شل النظام، مما يؤدي إلى تنفيذ تعليمات برمجية تعسفية على جهاز العميل. في نظام Windows، يتيح ذلك التحكم الكامل في المعلمات، بينما في أنظمة macOS وLinux، يتيح تنفيذ ملفات تعسفية مع تحكم محدود في المعلمات. وقد تم تنزيل الحزمة أكثر من 437,000 مرة.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: NVIDIA Nemo Framework (الإصدارات المتأثرة غير محددة) الوصف: تتعلق المشكلة بخلل في تبديل المسار النسبي ناتج عن الكتابة التعسفية للملفات، مما قد يؤدي إلى تنفيذ التعليمات البرمجية والتلاعب بالبيانات. التوصيات: لا توجد حاليًا أي معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

Design document functions that receive a user HTTP request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions include `list`, `show`, `rewrite`, and `update`. An attacker can leak the session component using an HTML-like output, insert the session as an external resource, or store the credential in a local document with an `update` function. For the attack to succeed, the attacker must be able to insert the design documents into the database and then manipulate a user to access a function from that design document.

A heap out-of-bounds read issue exists in ClickHouse's LZ4 compression codec when parsing a malicious query. The `LZ4::decompressImpl()` loop reads a 16-bit unsigned user-supplied value (`offset`) from the compressed data. This `offset` is later used in the length of a copy operation without checking the lower bounds of the source of the copy operation.

A heap out-of-bounds read issue exists in ClickHouse's LZ4 compression codec when parsing a malicious query. The `LZ4::decompressImpl()` loop reads a 16-bit unsigned user-supplied value (`offset`) from the compressed data, which is later used in the length of a copy operation without checking the upper bounds of the source of the copy operation.

The issue is related to a divide-by-zero error in Clickhouse's Delta compression codec. This error occurs when parsing a malicious query, where the first byte of the compressed buffer is used in a modulo operation without being checked for 0.

The issue is related to a divide-by-zero error in Clickhouse's DeltaDouble compression codec. This occurs when parsing a malicious query, where the first byte of the compressed buffer is used in a modulo operation without being checked for 0.

The issue is related to a divide-by-zero error in ClickHouse's Gorilla compression codec. This occurs when parsing a malicious query, where the first byte of the compressed buffer is used in a modulo operation without being checked for 0.

The issue is related to a heap buffer overflow in ClickHouse's LZ4 compression codec. This occurs when parsing a malicious query, as there is no verification that copy operations do not exceed the destination buffer's limits. Specifically, the arbitrary copy operation in the LZ4::decompressImpl loop can lead to this overflow. An attacker could potentially exploit this vulnerability to execute arbitrary code remotely.

The issue is related to a heap buffer overflow in ClickHouse's LZ4 compression codec. This occurs when parsing a malicious query, as there is no verification that copy operations in the LZ4::decompressImpl loop do not exceed the destination buffer's limits. The vulnerable copy operation is in a different wildCopy call, making it similar to a previously identified issue.

An issue was discovered that allows for a bypass of access control.

An issue was discovered in multiple models of Axis IP Cameras, where there is an exposed insecure interface.

An issue was discovered in multiple models of Axis IP Cameras, where there is Shell Command Injection.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the improper passing of an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This method improperly passes an attacker-controlled pointer to a native function, potentially leading to code execution.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This method improperly passes an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the class improperly passing an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the class improperly passing an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is done by improperly passing an attacker-controlled pointer to a native function.