Shin24

تتعلق المشكلة بثغرة أمنية تتمثل في «التعديل غير المراقب بشكل صحيح لسمات الكائنات المحددة ديناميكيًا»، مما يسمح بـ«حقن الكائنات» في Drupal core.

The issue is a Direct Request ('Forced Browsing') vulnerability in Apache OFBiz, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers. This vulnerability has been actively exploited by hackers, with over 25,000 requests targeting 4,000 unique sites detected by Imperva. The vulnerability allows for unauthenticated remote code execution.

The backup management module of the Admin CP in MyBB may accept `.htaccess` as the name of the backup file to be deleted, potentially exposing stored backup files over HTTP on Apache servers.

The default list of disallowed remote hosts in MyBB does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) issue. The Configuration File's Disallowed Remote Addresses list (`$config['disallowed remote addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources.

A problematic issue has been found in phpBB, affecting the function main of the file phpBB/includes/acp/acp icons.php of the component Smiley Pack Handler. The manipulation of the argument `pak` leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue.