Thomas Chauchefoin

يقوم مكون `ScopingHttpClient` في Symfony HttpClient بدمج خيارات النطاق الافتراضي، مثل `auth bearer` أو `auth basic` في الطلب قبل حل عنوان URL نسبي مقابل `base uri`. يسمح هذا بإرسال مرجع مسار شبكة إلى أصل مختلف مع الاحتفاظ ببيانات اعتماد النطاق الافتراضي، مما يؤدي إلى احتمال الكشف عن هذه البيانات لخادم يسيطر عليه المهاجم. يحدث هذا عندما يقع عنوان URL الذي تم حله خارج أصل URI الأساسي، بما في ذلك الحالات التي يكون فيها المنفذ أو معلومات المستخدم مختلفة على نفس المضيف. يمكن الوصول إلى هذه الثغرة عندما يتحكم المهاجم في بداية عنوان URL الممرر إلى عميل تم بناؤه باستخدام `base uri` وبيانات اعتماد، بما في ذلك تلك التي تم إنشاؤها باستخدام `HttpClient::createForBaseUri()` أو تكوينها تحت `framework.http client.scoped clients`.

يقوم برنامج Fickling، وهو أداة فك التجميع والمحلل الثابت لملفات pickle في لغة Python، بتصنيف ملفات pickle التي تستخدم `runpy.run path()` أو `runpy.run module()` في لغة Python بشكل خاطئ على أنها SUSPICIOUS بدلاً من OVERTLY MALICIOUS. قد يحدث هذا التصنيف الخاطئ عندما يعتمد المستخدم على مخرجات Fickling لتحديد أمان عملية إزالة تسلسل ملفات pickle، مما قد يؤدي إلى تنفيذ كود يتحكم فيه المهاجم. تؤثر هذه المشكلة على أي سير عمل أو منتج يستخدم Fickling كبوابة أمان لإزالة تسلسل ملفات pickle.

The issue allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component. This affects products that are no longer supported by the maintainer. The problem has been reportedly exploited in real-world attacks.

The Zscaler Client Connector for macOS did not sufficiently validate RPC clients, allowing a local adversary without sufficient privileges to potentially shutdown the Zscaler tunnel by exploiting a race condition.

The issue is related to insufficient input validation in Visual Studio Code, allowing an attacker to execute arbitrary code using a specially crafted file.

The issue is related to argument injection during the tagging of a new release. This could allow a remote attacker to disclose protected information. Unprivileged user accounts with at least one SSH key can read arbitrary files on the system, potentially leaking configuration files with database credentials, such as `[database]` and `[security] SECRET KEY`, as well as exfiltrating TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.

The vulnerability in Visual Studio Code is related to insufficient input validation. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

The issue is related to the `VcsDriver::getFileContent` method in Composer, a dependency manager for PHP. If a user can control the `$file` or `$identifier` argument, it may lead to a code injection vulnerability. This vulnerability can be exploited on platforms like packagist.org, where the `readme` field in composer.json can be used to inject parameters into hg/Mercurial via the `$file` argument or into git via the `$identifier` argument. To the best of our knowledge, this vulnerability was not actively exploited. The vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

The issue is related to improper access control in the setup.php file of Zabbix Frontend, allowing unauthenticated users to access certain setup steps that should only be accessible by super-administrators. This could potentially enable a malicious actor to change the configuration of Zabbix Frontend.

The issue is related to incorrect code generation management in the Visual Studio Code editor. Exploitation of this issue may allow an attacker to execute arbitrary code.

Cachet is an open source status page system. Authenticated users, regardless of their privileges, can exploit a new line injection in the configuration edition feature and gain arbitrary code execution on the server. This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.

Cachet is an open source status page system. Authenticated users, regardless of their privileges, can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access the administration dashboard.

An issue was discovered where Views/PrivateMessages/View.cshtml does not call `HtmlUtils.SanitizeHtml` on a private message, potentially leading to issues with private message handling.

An issue was discovered where the Views/Boards/Partials/ ForumPost.cshtml file does not call `HtmlUtils.SanitizeHtml` on certain text for a forum post, potentially leading to issues with unsanitized text.

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.11 Description: The issue concerns the Twig processing of static pages in Grav, a file-based Web-platform. Any administrative user allowed to create or edit pages can enable Twig processing in the front matter. Since the Twig processor runs unsandboxed, this behavior can be exploited to gain arbitrary code execution and elevate privileges on the instance. Recommendations: For versions prior to 1.7.11, update to version 1.7.11 to address the issue. As a temporary workaround, consider blocking access to the `/admin` path from untrusted sources to reduce the probability of exploitation. After updating, consider configuring the `system.twig.safe functions` and `system.twig.safe filters` options to manually allow arbitrary PHP functions and filters.

The issue is related to the incorrect handling of module loading in the modprobe child process, allowing a local non-root attacker to exploit the MODPROBE OPTIONS environment variable and read arbitrary root files. This is a privilege escalation vulnerability.

The issue is related to the SAML SSO authentication in Zabbix. When SAML SSO authentication is enabled, a malicious actor can modify session data because the user login stored in the session is not verified. This can allow an unauthenticated actor to escalate privileges and gain admin access to Zabbix Frontend. The attack requires SAML authentication to be enabled, and the actor must know the username of a Zabbix user or use the guest account, which is disabled by default.

The issue concerns the wp-google-maps plugin for WordPress, where the REST API in includes/class.rest-api.php does not properly sanitize field names before executing a SELECT statement.

The issue is related to a command injection vulnerability in the PHP connector of elFinder.

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: The issue allows attackers with control over the HTTP server queried in preparation of job import to read arbitrary files and perform a denial of service attack. This is due to an XML external entity processing vulnerability in the src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java file. Recommendations: For Jenkins Job Import Plugin versions 2.1 and earlier, update to a version later than 2.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.