Yaniv Nizry

عندما يتم تكوين البرنامج لتخزين الكائنات محليًّا، فإنه يسمح للمهاجم بإنشاء ملف عبر نقطة النهاية `CreateResource`. ويتم تحقيق ذلك عن طريق تضمين تسلسل لاجتياز المسار في اسم الملف، مما يسمح بكتابة ملفات عشوائية على الخادم.

الإصدار 0.22 من Memos معرض لخطر «التنفيذ البرمجي عبر المواقع» (XSS) المخزن من خلال ميزات تحميل المرفقات وصورة الملف الشخصي للمستخدم. لا يقوم البرنامج بالتحقق من نوع محتوى البيانات التي تم تحميلها قبل إتاحتها، مما قد يسمح لمهاجم معتمد بتصعيد امتيازاته عندما يتم عرض هجوم XSS المخزن من قبل أحد المسؤولين.

تسمح هذه الثغرة لمهاجم بالوصول إلى معلومات حساسة من خلال اجتياز المسار (path traversal) في نقطة نهاية واجهة برمجة التطبيقات (API) ”/admin/compass“. ترتبط هذه الثغرة بأخطاء في معالجة المسارات النسبية للمجلدات، والتي يمكن لمهاجم عن بُعد استغلالها لتهديد سرية وسلامة وتوافر المعلومات المحمية.

تسمح هذه الثغرة بـ XSS المنعكس عبر نقطة نهاية واجهة برمجة التطبيقات (API) ”/admin/compass“. عند حث مستخدم مسجل الدخول على النقر على رابط، يمكن تنفيذ كود JavaScript تعسفي.

تسمح هذه الثغرة لمستخدم مسجل الدخول بتجاوز التحقق من نوع الملف عند تحميل ملف عبر نقطة النهاية ”/admin/media/upload“. وقد يؤدي ذلك إلى تحميل برنامج ويب شيل (web shell)، مما يؤدي إلى تنفيذ تعليمات برمجية عشوائية على الخادم. ويجري استغلال هذه الثغرة بشكل نشط.

The issue is a Cross-Site Request Forgery (CSRF) that affects the Flask endpoints. This allows for unauthorized requests to be made on behalf of the user.

The issue allows for Cross Site Scripting (XSS) via the `/update` endpoint. This affects products that are no longer supported by the maintainer.

The issue is related to the built-in command line interface (CLI) of the Jenkins server, which has a weakness in its authentication procedure. This weakness can be exploited by a remote attacker to perform a cross-site WebSocket hijacking (CSWSH) attack, allowing the execution of CLI commands on the Jenkins controller. The vulnerability is due to the lack of origin validation of requests made through the CLI WebSocket endpoint.

The issue arises from incorrect handling of DOM processing instructions, allowing bypassing of the cross-site scripting mechanism of typo3/html-sanitizer.

The issue involves the need for stronger revision number limitations on file serving endpoints to enhance cache poisoning protection. This is a measure to improve security against potential cache poisoning attacks, which could compromise the integrity of cached data.

The issue arises from an encoding problem in the serialization layer of TYPO3 HTML Sanitizer, allowing malicious markup nested in a `noscript` element to bypass the cross-site scripting mechanism. The `noscript` element is disabled by default but may be enabled in custom configurations. This enables the bypassing of the cross-site scripting protection provided by TYPO3 HTML Sanitizer.

The issue exists because the application allows a user to control the path of the folder to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. This can lead to unauthenticated arbitrary folder creation, and potentially to remote code execution (RCE).

A deserialization issue in the inikulin replicator allows remote attackers to run arbitrary code via the `fromSerializable` function in the `TypedArray` object.

The issue concerns the mishandling of backslash characters in certain URI schemes, such as `http:/`, which can lead to incorrect interpretation of the URI as a relative path. This can result in hostname spoofing when using affected versions to determine a URL's hostname. Impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior, depending on library usage and attacker intent. For example, a URL like `https:/expected-example.com/path` can be used to bypass security decisions.

A mutation XSS affects users calling `bleach.clean` with specific allowed tags and the keyword argument `strip comments=False`. This issue may allow a remote attacker to impact the confidentiality and integrity of protected information. The affected tags include `svg`, `math`, `p`, `br`, `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp`. Note that none of these tags are in the default allowed tags and `strip comments` defaults to `True`.

The issue is an open redirect vulnerability that could cause the Jupyter server to redirect the browser to a different malicious website. All Jupyter servers running without a base url prefix are technically affected. However, these maliciously crafted links can only be reasonably made for known Jupyter server hosts. A link to a Jupyter server may appear safe but ultimately redirect to a spoofed server on the public internet.

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

A mutation XSS issue affects users calling `bleach.clean` with specific settings, including whitelisting `svg` or `math` tags, allowing RCDATA tags, and setting the `strip` keyword argument to `False`. This could potentially allow a remote attacker to impact data integrity.

The issue exists due to inadequate protection of web page structure. Exploitation can allow a remote attacker to conduct a cross-site scripting (XSS) attack. A mutation XSS affects users calling `bleach.clean` with `noscript` and a raw tag in the allowed/whitelisted tags option.