Shubham Shah

توجد مشكلة في مكون محرك المصادقة (Authentication Engine) في Oracle Access Manager. يمكن لمهاجم غير مصدق عليه ولديه وصول إلى الشبكة عبر HTTP اختراق النظام، مما قد يؤدي إلى وصول غير مصرح به للقراءة أو التحديث والإدراج والحذف غير المصرح به لمجموعة فرعية من البيانات التي يمكن الوصول إليها.

يحتوي التطبيق على ثغرة أمنية من نوع تزوير الطلبات من جانب الخادم (SSRF) غير المرئي قبل المصادقة في المكون `portal-settings-authentication-opensso-web`. ويرجع ذلك إلى عدم التحقق بشكل صحيح من صحة عناوين URL التي يقدمها المستخدم. يمكن للمهاجم استغلال هذه الثغرة لإجبار الخادم على إرسال طلبات HTTP عشوائية إلى الأنظمة الداخلية، مما قد يؤدي إلى استكشاف الشبكة الداخلية أو المزيد من الاستغلال.

توجد ثغرة أمنية في البرمجة النصية عبر المواقع (XSS) المنعكسة تسمح لمهاجم بعيد غير مصدق عليه بحقن جافا سكريبت. تقع الثغرة الأمنية في الملف `modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry cover image caption.jsp`.

تتأثر الإصدارات 6.5.23 وما قبلها من Adobe Experience Manager بثغرة أمنية ناتجة عن خطأ في التكوين قد تؤدي إلى تنفيذ تعليمات برمجية تعسفية. يمكن للمهاجم استغلال هذه الثغرة لتجاوز آليات الأمان وتنفيذ التعليمات البرمجية دون تدخل من المستخدم. يؤدي استغلال هذه الثغرة إلى تغيير نطاق الوصول. يتم استغلال هذه الثغرة بشكل نشط، كما يتوفر دليل إثبات المفهوم للجمهور. ترتبط هذه الثغرة بخدمة servlet تم تكوينها بشكل غير صحيح تقوم بتقييم تعبيرات OGNL غير مصدقة، مما قد يسمح للمهاجمين بتنفيذ أوامر تعسفية. تظهر هذه الثغرة الأمنية عند تمكين وضع التطوير في Struts.

توجد ثغرة أمنية من نوع البرمجة النصية عبر المواقع (XSS) المنعكسة في Liferay Portal وDXP. يمكن لمهاجم بعيد غير مصدق إدخال كود JavaScript في المكون `/modules/apps/marketplace/marketplace-app-manager-web`. يمكن للمهاجم استغلال هذه الثغرة عن طريق إنشاء رابط URL ضار يحتوي على البرنامج النصي المُحقن. وعندما ينقر المستخدم على هذا الرابط، يقوم المتصفح بتنفيذ البرنامج النصي، مما قد يسمح للمهاجم بالوصول إلى جلسة عمل المستخدم وبياناته. يتضمن الاستغلال إرسال طلب مُعدّ خصيصًا إلى نقطة النهاية `/o/marketplace-app-manager-web/icon.jsp` مع معلمة `iconURL` ضارة. المعلمة المعرضة للخطر هي `iconURL`.

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and certain conditions are met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. It is estimated that over 3.1 million services are potentially affected.

The issue is related to a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS FTP Server. This vulnerability can be exploited by a pre-authenticated attacker to execute remote commands on the underlying WS FTP Server operating system. The vulnerability has been observed being actively exploited in the wild, and it is estimated that a significant number of devices may be affected.

The issue is related to the incorrect management of code generation in the Metabase platform, which could allow remote code execution on the server. The core problem is that the embedded in-memory database H2 exposes ways for a connection string to include code that is then executed by the process running the embedded database. This means a user-supplied string can be used to inject executable code. The validation API, which can be called without validation, is the primary vector used for exploitation. Approximately 58,710 results are potentially affected.

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in cPanel. The issue occurs on the cpsrvd error page via an invalid webcall ID. This vulnerability can be exploited by a remote attacker to impact the confidentiality and integrity of protected information. There have been reports of hacktivists sharing attack methods and scripts to identify and exploit this vulnerability.

The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.

The issue is related to insufficient request checking on the server side, allowing a remote, authenticated user to perform a full read server-side request forgery via a batch endpoint. This can be exploited to conduct SSRF attacks.

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk (affected versions not specified) Description: A security issue has been discovered in the SolarWinds Web Help Desk product, where hard-coded credentials allow an attacker with local access to the host machine to execute arbitrary HQL queries against the database. This enables the attacker to steal password hashes of users or insert arbitrary data into the database. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient validation of incoming requests, allowing a remote attacker to impact the confidentiality and integrity of protected information using specially crafted HTTP requests. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response. This is a Server-Side Request Forgery (SSRF) vulnerability.

An issue has been discovered where an account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows.

The server in Jamf Pro has a vulnerability affecting integrity and availability. This issue allows for a Server-Side Request Forgery (SSRF) attack. Jamf Nation will also publish an article about this vulnerability.

The issue is related to an insecure deserialization attack that can lead to remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. It is reported that the Australian Department of Defence's ForceNet platform, which uses Sitecore XP, was affected by a ransomware attack, potentially exposing 30,000 to 40,000 personal records. However, it is not confirmed if this incident is directly related to the vulnerability in question.

The issue allows local users to gain privileges via unspecified vectors due to the use of setuid-root permissions for /opt/bin/cli.

A directory traversal issue allows remote attackers to read files by crafting a URI.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `code`, `error`, or `error description` parameters in the oauth callback.php file.

The issue is related to the Content Security Policy (CSP) implementation in the Messages component of Apple OS X. It allows remote attackers to obtain sensitive information via a javascript: URL. The vulnerability is associated with a lack of protection for sensitive data, which can be exploited by a remote attacker to gain confidential information by navigating to a JavaScript link.