George A. Theall

O problema está relacionado a uma vulnerabilidade de falsificação de solicitação do lado do servidor (SSRF) no arquivo feed-proxy.php. Essa vulnerabilidade pode permitir que um invasor falsifique solicitações do servidor, levando ao acesso não autorizado a recursos internos.

The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the `messageSignedText` parameter to the `gpg check sign pgp mime` function in `gpg hook functions.php`. A parameter value can be set in the contents of an e-mail message.

A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the `format` parameter stored in the `$blogEntry` variable. This variable is not properly handled by the `insert record` function, which calls ` adodb column sql` in the adodb layer. The issue arises because the data type is not converted to an int.

The issue concerns a remote file inclusion vulnerability in the upgrader.php file of Vanilla CMS. This vulnerability can be exploited when the /conf/old settings.php file exists, allowing remote attackers to execute arbitrary PHP code via a URL in the `RootDirectory` parameter. However, the vulnerability has been disputed for version 1.0, and it is unclear whether older versions are affected.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `configArr[pathtodir]` parameter in the config.php file.

The issue involves multiple vulnerabilities in various packages of the openSUSE operating system, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The Linux kernel is also affected, with versions prior to 2.6.17.3 and 2.6.16.23 being vulnerable to a denial of service (crash) via a packet without any chunks.