Sam Sanoop

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات Hackney 0.0.0 وما بعدها الوصف: تنشأ المشكلة بسبب المعالجة غير السليمة لعناوين URL من قِبل الوحدة المدمجة URI وبرنامج Hackney، مما يؤدي إلى تزوير الطلبات من جانب الخادم (SSRF). بالنظر إلى عنوان URL مثل http://127.0.0.1?@127.2.2.2/، تحدد وظيفة URI المضيف بشكل صحيح على أنه 127.0.0.1، لكن برنامج hackney يفسر المضيف بشكل خاطئ على أنه 127.2.2.2/. يمكن استغلال هذه الثغرة عندما يعتمد المستخدمون على وظيفة معالجة عناوين URL للتحقق من المضيف. التوصيات: بالنسبة لإصدارات Hackney 0.0.0 وما بعدها، يُنصح بتعطيل وظيفة معالجة عناوين URL حتى يتوفر تصحيح. قم بتقييد الوصول إلى الوحدة النمطية المعرضة للثغرة لتقليل مخاطر الاستغلال. تجنب استخدام الوحدة النمطية `URI` للتحقق من المضيف في نقاط نهاية واجهة برمجة التطبيقات (API) المتأثرة حتى يتم حل المشكلة. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

A code execution issue exists due to improper neutralization of special elements used in an OS command. This issue can be exploited by adding an untrusted Helm catalog or modifying the URL configuration used to download KDM, allowing for command injection in the underlying Rancher host. By default, only the Rancher admin has permission to manage these configurations. The issue can potentially be exploited in two ways: adding an untrusted Helm catalog that contains maliciously designed repo URL configuration in Helm charts, or modifying the URL configuration used to download KDM releases.

The issue arises from the failure to sanitize `gcov` arguments before they are provided to the `popen` method. This lack of sanitization can lead to potential exploitation.

The issue allows a malicious module to overwrite files on an arbitrary file system through the module install functionality.

The issue relates to the concentration of arrays by ini parser.js. If user input is provided, an attacker can potentially overwrite and pollute the object prototype of a program.

The issue affects browserless-chrome, where user input from the "workspace endpoint" is used to create a file path `filePath`. This `filePath` is then fetched and sent back to the user, allowing for the potential to escape and fetch arbitrary files from a server.

This issue relates to the `deepExtend` function, part of the utils directory. Depending on user input, an attacker can overwrite and pollute the object prototype of a program.

The issue allows request smuggling attacks when agoo is used as a backend and a frontend proxy is also vulnerable. This is due to incorrect parsing of `Content-Length` and `Transfer Encoding` headers, which can lead to HTTP pipelining issues and request smuggling attacks. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers. Additionally, sending the `Content-Length` header twice or using invalid `Transfer Encoding` headers can be leveraged for TE:CL smuggling attacks.

The issue allows for Request Smuggling attacks due to incorrect parsing of Content-Length and Transfer encoding headers. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Additionally, invalid Transfer Encoding headers are parsed as valid, which could be leveraged for TE:CL smuggling attacks. The project is deprecated and no longer maintained.

The issue allows modification of object properties. Specifically, the `merge` method could be tricked into adding or modifying properties of the `Object.prototype`.

The issue arises from the mishandling of the xlink namespace by the sanitizer, allowing bypass of svg-sanitize using the `xlink:href` attribute.

The issue allows for potential timing attacks, which under certain conditions, could lead to the practical recovery of the long-term private key generated by the library. This is due to the possible leakage of a bit-length of the scalar during scalar multiplication on an elliptic curve.