Darren Mcdonald

Existe um problema onde atacantes com acesso físico podem executar parâmetros arbitrários do carregador Linux. Isso é possível ao escrever em uma área de configuração não criptografada e não assinada que é lida pelo carregador de inicialização assinado. Isso permite a injeção de parâmetros maliciosos de linha de comando do kernel que são executados com privilégios do ambiente de inicialização. Como o ataque não modifica o código de inicialização medido, ele não dispara falhas de medição do TPM PCR. As medições TPM PCR (Trusted Platform Module Platform Configuration Register) são usadas para garantir a integridade do processo de inicialização.

Existe uma falha de bypass de secure boot no estágio de boot do GRUB. Um invasor com acesso físico pode obter acesso root não autorizado ao colocar um arquivo vazio não assinado chamado `igel.conf` em uma partição. Isso explora um comportamento de verificação de assinatura fail-open no GRUB, permitindo que o invasor acesse um prompt interativo do GRUB e inicie o kernel do dispositivo com argumentos de linha de comando adicionais. Esse processo resulta em um shell de root com o disco desbloqueado, enquanto os valores de TPM PCR (Platform Configuration Registers) permanecem inalterados.

The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various fields, including the Additional Information field to "challenge.php", the Additional Information or Contact information field to "joinus.php", the War Report field to "admin/admin.php" in a finishwar action, or the Nick field to "profile.php".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `ratearticleselect` parameter in the "article.php" file.

The issue allows remote attackers to bypass intended member restrictions and read news posts. This is achieved by modifying the `newsid` parameter in a "printnews" action.

The issue concerns the `createRandomPassword` function, which uses a limited range of values for the seed argument in the PHP `mt srand` function. This limitation makes it easier for remote attackers to determine randomly generated passwords through a brute-force attack.

The issue allows remote attackers to bypass timeout and logout actions, retaining access for a long period. This is possible because the software uses static session cookies that depend only on a user's password. By leveraging knowledge of a session cookie, attackers can exploit this.

The issue allows remote attackers to cause a denial of service, specifically memory consumption, by providing a large integer in the `ratearticleselect` parameter. This is related to the "article.php" component.

The issue allows remote authenticated users to trigger crafted SMTP traffic via specific characters in an org name or e-mail address, related to a "2nd Order SMTP Injection" issue. This can be achieved by including (1) double quote and newline characters in an org name or (2) double quote characters in an e-mail address.

The issue allows remote authenticated users to cause a denial of service or spoof votes and comments by selecting a conflicting e-mail address, as the software does not require unique e-mail addresses for user accounts.

The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, as the authentication fields lack an off autocomplete attribute.

The password reset feature generates different error messages for failed reset attempts depending on whether the e-mail address is registered. This allows remote attackers to enumerate user accounts via a series of requests.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the `return to` parameter. Additionally, remote authenticated users can redirect users to arbitrary web sites and conduct phishing attacks via crafted characters in the domain name of a subdomain.

The issue allows remote attackers to inject arbitrary web script or HTML via the description field of a new vote or the eject member proposal feature, potentially leading to cross-site scripting (XSS) attacks.