Sim4N6

اسم البرنامج المعرض للخطر والإصدارات المتأثرة إصدارات GitLab EE من 18.2 إلى 18.8.9، ومن 18.9 إلى 18.9.5، ومن 18.10 إلى 18.10.3 الوصف تتعلق المشكلة بعدم صحة التحقق من صحة المدخلات في استعلامات GraphQL، مما قد يسمح لمستخدم مسجّل الدخول بإحداث هجوم «رفض الخدمة» على مثيل GitLab. التوصيات التحديث إلى الإصدار 18.8.9 أو أحدث من GitLab EE. التحديث إلى الإصدار 18.9.5 أو أحدث من GitLab EE. التحديث إلى الإصدار 18.10.3 أو أحدث من GitLab EE.

يمكن لمستخدم غير معتمد أن يتسبب في حدوث رفض الخدمة عن طريق إرسال مدخلة مصممة خصيصًا إلى نقطة نهاية طلب الدمج. تتضمن هذه المشكلة رفض الخدمة عن طريق التعبير العادي.

تم اكتشاف مشكلة في GitLab CE/EE تسمح للمهاجم بتشغيل حلقة إعادة توجيه لا نهائية، مما قد يؤدي إلى حالة رفض الخدمة. تؤثر هذه المشكلة على إصدارات مختلفة من GitLab CE/EE، مما يسمح للمهاجم باستغلالها والتسبب في رفض الخدمة.

تم اكتشاف ثغرة في GitLab CE/EE تسمح للمهاجمين بتجاوز إجراءات الحماية الخاصة بتدفق OAuth للأجهزة. وهذا يتيح إرسال نموذج التفويض من خلال تفاعل بسيط من جانب المستخدم.

تتعلق المشكلة بثغرة أمنية في الدالة `valid host()` التي تستخدم `socket.gethostbyname()`، مما يجعلها عرضة لإساءة استخدام SSRF من خلال تقنية إعادة ربط DNS. ترتبط هذه الثغرة بـ Mobile Security Framework (MobSF)، وهي أداة لاختبار الاختراق وتحليل البرامج الضارة وتقييم الأمان تقوم بإجراء تحليلات ثابتة وديناميكية.

تؤثر مشكلة رفض الخدمة على توفر GitLab من خلال إنشاء رموز غير محدودة. ويتم ذلك عبر المعلمة `scopes` في رمز الوصول الشخصي.

The issue concerns an open-source project management tool that uses ** wildcard support to retrieve images from any hostname, potentially allowing an attacker to induce the server into performing requests to unintended locations.

The issue is related to the use of a regular expression with inefficient computational complexity in GitLab, a software platform based on git for collaborative code work. Exploitation of the issue could allow a remote attacker to cause a denial of service by sending a specific POST request, potentially via a large `glm source` parameter.

Name of the Vulnerable Software and Affected Versions: Yeti versions prior to 2.1.11 Description: The issue concerns a denial of service vulnerability. Remote user-controlled data tags can lead to Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks, potentially worsened by the use of special Unicode characters. Recommendations: For versions prior to 2.1.11, update to version 2.1.11 to resolve the issue. As a temporary workaround, consider restricting the use of remote user-controlled data tags until the patch is applied.

MindsDB is a platform for building artificial intelligence from enterprise data. A threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding, which can also lead to denial of service.

The issue is related to a denial of service vulnerability due to the lack of constraints on user-controlled data `profiler runs`. This allows for the allocation of resources on the server side with no limitation, potentially leading to a denial of service by remotely controlled data. The vulnerability is caused by the fact that the `profiler runs` variable is not constrained to any limitation, which would lead to allocating resources on the server side with no limitation.

The issue arises from the lack of limitation on the length of filenames and the costly use of Unicode normalization with the form NFKD under the hood of the `secure filename()` function. This can lead to an application-level denial of service when a user intentionally uploads a file or retrieves a filename with a large Unicode name.

The NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr webapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this issue may lead to a server-side denial of service.

The issue arises when an authenticated user uploads an avatar image with a large Unicode filename, leading to a server-side denial of service under Windows. This is due to the lack of limitation on the filename length and the costly use of Unicode normalization with the form NFKD on Windows OS.

The issue concerns an expression injection vulnerability in the `/mehah/otclient` "Analysis - SonarCloud" workflow, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow.

The issue arises from the function `lookupPreprocess()` which applies transformations to a string by disabling characters in the regex `[- .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[- .]`. This can be achieved with equivalent Unicode characters, resulting in omitted characters being reintroduced. The `lookupPreprocess()` function is used to search for themes loosely, and the actual security impact is classified as low.

The issue is related to a Post-Unicode normalization problem. This occurs when security checks are performed before Unicode normalization, allowing Unicode character equivalents to resurface after normalization.

A configuration injection occurs when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is shell code execution from the configuration file values.

The issue is related to an unsafe extraction performed using `tarfile.extractall()` from a remotely retrieved tarball, which may lead to the writing of extracted files to an unintended location. This is sometimes referred to as a TarSlip or a ZipSlip variant. An attacker may leverage this to overwrite any local file that the server process has access to. There is no risk of file exposure with this vulnerability. API Endpoints: `/<name>` Vulnerable Parameters or Variables: `name`, `file`, `original file name`, `source` Function Names: `put()`, `extractall()` The vulnerability can be exploited by crafting a malicious tarball with a filename path, such as ../../../../../../../../etc/passwd, and then serving the archive remotely, proceeding to the PUT request of the tarball through mindsdb, and overwriting the system files of the hosting server.

MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack archive()` from a remotely retrieved tarball, which may lead to the writing of the extracted files to an unintended location. This issue is sometimes called a TarSlip or a ZipSlip variant. Unpacking files using the high-level function `shutil.unpack archive()` from a potentially malicious tarball without validating that the destination file path remained within the intended destination directory may cause files to be overwritten outside the destination directory. An attacker could craft a malicious tarball with a filename path, such as `../../../../../../../../etc/passwd`, and then serve the archive remotely using a personal bucket `s3`, thus, retrieve the tarball through MindsDB and overwrite the system files of the hosting server.