Atorralba

O Owncast é um servidor de streaming de vídeo ao vivo e chat de código aberto, auto-hospedado e descentralizado para um único usuário. O aplicativo Owncast disponibiliza uma API de administrador na URL “/api/admin”. O endpoint “emoji/delete” dessa API permite que administradores excluam emojis personalizados, que são salvos no disco. O parâmetro `name` é obtido da solicitação JSON e anexado diretamente ao caminho do arquivo que aponta para o emoji a ser excluído. Ao usar sequências de traversal de caminho (../), invasores com privilégios administrativos podem explorar esse endpoint para excluir arquivos arbitrários no sistema, fora do diretório de emojis.

The Home Assistant Companion for Android app is vulnerable to arbitrary URL loading in a WebView, enabling attacks such as arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2.

The issue concerns a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers can trick clients into communicating with a malicious server, including specially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on.

The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs.

The Aerospike Java client has a vulnerability related to the deserialization of Java objects received from the server. Attackers can trick clients into communicating with a malicious server, which can include crafted objects in its responses that force the client to execute arbitrary code when deserialized. This can be abused to take control of the machine the client is running on. The issue is related to the `ObjectInputStream` used in the `Buffer.bytesToObject` method, which deserializes objects from the message bytes without proper validation.

Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the `SAMLPOSTProfileServlet` servlet.

The issue allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system. This is due to the lack of restriction on the path of attached files in the Polyspace Notification post-build step.

The issue allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks.

This is a path traversal vulnerability when Gradle deals with Tar archives, often referenced as TarSlip, a variant of ZipSlip. When unpacking Tar archives, Gradle did not check that files could be written outside of the unpack location, which could lead to important files being overwritten anywhere the Gradle process has write permissions. For a build reading Tar entries from a Tar archive, this issue could allow Gradle to disclose information from sensitive files through an arbitrary file read. To exploit this behavior, an attacker needs to either control the source of an archive already used by the build or modify the build to interact with a malicious archive. Gradle uses Tar archives for its Build Cache, and if an attacker had control of a remote build cache server, they could inject malicious build cache entries that leverage this vulnerability.

The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction on the AWS SQS queue name path parameter in an HTTP endpoint.

The Omni-notes Android app has an issue with insufficient path validation when displaying note details received through an externally-provided intent. This allows malicious applications on the same device to force Omni-notes to copy files from its internal storage to the external storage directory, making them accessible to any component with permission to read the external storage.

The issue allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content. This is due to the lack of restriction on the name and resulting uploaded file name of Stashed File Parameters.

The issue allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system. This is due to the plugin not restricting the path of files in a method implementing form validation. The plugin allows specifying files in the `userContent/` directory for use as link icons.

The issue is related to a stored cross-site scripting (XSS) vulnerability. This occurs because the LoadComplete test name is not properly escaped, allowing attackers with Item/Configure permission to exploit this weakness. The vulnerability is present in the test result page.

A cross-site request forgery (CSRF) vulnerability allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML. The plugin does not perform permission checks in multiple HTTP endpoints, which can be exploited by attackers with Overall/Read permission. Additionally, the plugin's XML parser is not configured to prevent XML external entity (XXE) attacks, allowing attackers to extract secrets from the Jenkins controller or perform server-side request forgery. The affected HTTP endpoints do not require POST requests, resulting in a CSRF vulnerability.

O aplicativo Tasks.org para Android apresenta uma vulnerabilidade relacionada à divulgação de informações confidenciais. A atividade `ShareLinkActivity.kt` do aplicativo lida com intents de “compartilhamento” e pode copiar arquivos do armazenamento interno para o externo se os caminhos dos arquivos nos intents não forem validados. Isso permite que aplicativos maliciosos no mesmo dispositivo acessem informações confidenciais, incluindo notas, preferências e credenciais criptografadas de integração com CalDav.

O problema está relacionado a um ataque de negação de serviço por expressão regular (ReDoS) na forma como o Apache Tapestry lida com tipos de conteúdo. Tipos de conteúdo especialmente criados podem causar um backtracking catastrófico, levando um tempo exponencial para ser concluído, devido à expressão regular usada no parâmetro da classe `org.apache.tapestry5.http.ContentType`. Essa vulnerabilidade não pode ser acionada apenas por solicitações da web no código do Tapestry e só ocorreria se código não pertencente ao Tapestry passasse entradas externas para o construtor da classe `ContentType`.

A questão está relacionada a um problema de segurança, mas não foram fornecidos detalhes.

O problema pode levar à divulgação de informações confidenciais, permitindo que um aplicativo não autorizado, sem a permissão necessária `MANAGE DOCUMENTS`, visualize miniaturas de imagens para as quais não tem permissão de visualização.

O aplicativo Nextcloud News para Android apresenta uma falha de segurança na qual um aplicativo malicioso instalado no mesmo dispositivo pode enviar-lhe um Intent arbitrário que é refletido de volta, concedendo involuntariamente acesso de leitura e gravação a Content Providers não exportados no Nextcloud News para Android.