Sebastian

تسمح مكونة Bio.Entrez في Biopython باستخدام نوع الوثيقة «XML External Entity» (XXE)، وهي تقنية يتم من خلالها خداع محلل XML لمعالجة كيانات خارجية ضمن تعريف نوع الوثيقة، مما قد يؤدي إلى الوصول غير المصرح به إلى الملفات المحلية أو تزوير الطلبات من جانب الخادم.

An issue was discovered in LWsystems Benno MailArchiv, where attackers can cause cross-site scripting (XSS) via JavaScript content to a mailbox.

A CSRF issue was discovered.

The issue allows remote attackers to bypass a protection mechanism. This is achieved by exploiting the `post password` parameter.

The issue allows remote authenticated users to obtain sensitive information, including API keys, by exploiting certain API methods. Specifically, the "update repo", "get locks", and "get user groups" API methods are vulnerable.

The issue allows local users to invoke any configured PAM stack, potentially triggering unintended side effects, by passing a user-supplied argument to the pam start function within a setuid environment. This can be achieved via an arbitrary valid PAM service name. The vendor notes that the possibility of resultant privilege escalation may be unlikely.