Cursered

O problema está relacionado à transmissão de credenciais em texto simples, o que pode permitir que um invasor remoto capture pacotes e crie suas próprias solicitações, levando potencialmente ao acesso não autorizado a informações protegidas. Isso poderia permitir que um invasor contornasse a autenticação.

The issue is related to prototype pollution in the bitrix/templates/bitrix24/components/bitrix/menu/left vertical/script.js component of Bitrix24. This allows remote attackers to execute arbitrary JavaScript code in the victim's browser and possibly execute arbitrary PHP code on the server if the victim has administrator privileges. The exploitation is done by polluting ` proto [tag]` and ` proto [text]`.

The issue in Bitrix24 is related to global variable extraction in the bitrix/modules/main/tools.php component, allowing unauthenticated remote attackers to enumerate attachments on the server and execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also possible to execute arbitrary PHP code on the server. This is achieved via overwriting uninitialized variables.

An improper file stream access issue exists in the `/desktop app/file.ajax.php?action=uploadfile` component of Bitrix24. This allows unauthenticated remote attackers to cause a denial-of-service condition by using a crafted `tmp url`. The issue is related to a loop with an inaccessible exit condition. The affected API endpoint is `/desktop app/file.ajax.php` with the `action` parameter set to `uploadfile`. The vulnerable parameter is `tmp url`.

The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This can be exploited if a user opens a malicious markdown file in Typora or copies text from a malicious webpage and pastes it into Typora.

The issue allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora's main window via loading `typora://app/typemark/updater/update.html` in an `<embed>` tag. This can be exploited if a user opens a malicious markdown file in Typora or copies text from a malicious webpage and pastes it into Typora.

The issue is related to improper path handling, allowing a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This can be exploited if a user opens a malicious markdown file in Obsidian or copies text from a malicious webpage and pastes it into Obsidian.

The issue is related to improper path handling, which allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". This can be exploited if a user opens a malicious markdown file in Typora or copies text from a malicious webpage and pastes it into Typora.

The issue is a DOM-based XSS that allows arbitrary JavaScript code to run in the context of the MarkText main window. This can be exploited if a user copies text from a malicious webpage and pastes it into MarkText. The vulnerability is located in the src/muya/lib/contentState/pasteCtrl.js file.

Uma vulnerabilidade de cross-site scripting (XSS) refletido permite que invasores remotos executem scripts da Web ou HTML arbitrários por meio de endpoints inexistentes no caminho “/api2/html/”. Isso permite que os invasores possam manipular o conteúdo da Web.

O problema está relacionado a erros na representação de informações pela interface do usuário. Isso pode permitir que um invasor remoto realize ataques de spoofing, afetando o sistema.

A vulnerabilidade afeta o Proxmox Virtual Environment (PVE) e o Proxmox Mail Gateway (PMG) ao fazer proxy de solicitações HTTP entre o pve(pmg)proxy e o pve(pmg)daemon, permitindo que um invasor com uma conta sem privilégios crie uma solicitação HTTP e realize uma falsificação de solicitação do lado do servidor (SSRF) e a divulgação de quaisquer arquivos no servidor. Além disso, no Proxmox Mail Gateway, é possível a escalada de privilégios para a conta root@pam se o recurso de backup tiver sido utilizado, devido aos arquivos de backup possuírem permissões 0644 e conterem um valor de chave de autenticação (authkey).

Uma vulnerabilidade de injeção de CRLF no cabeçalho de resposta na interface web permite que um invasor remoto defina cookies no navegador da vítima com tamanho superior ao esperado pelo servidor, causando um DoS no lado do cliente. Isso afeta navegadores baseados no Chromium, pois eles permitem a injeção de cabeçalhos de resposta com %0d.