Josh Bressers

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

O problema decorre da forma como o crontab do FreeBSD calcula a soma MD5 da tarefa cron anterior e da nova para determinar se foram feitas alterações antes de copiar a nova versão. Especificamente, ele usa a função `MD5File()`, que recebe um `pathname` como argumento e é chamada com euid 0. Uma condição de corrida nesse processo pode levar a uma comparação MD5 arbitrária, independentemente das permissões de leitura.

**Nome do software vulnerável e versões afetadas: Squirrelmail versão 4.0 Descrição: O problema diz respeito ao uso do algoritmo de hash MD5, que está desatualizado, para senhas. Recomendações: Para o Squirrelmail versão 4.0, considere atualizar o mecanismo de hash de senhas para um algoritmo mais seguro como solução permanente. Como solução temporária, restrinja o acesso a áreas confidenciais do aplicativo para minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

O problema diz respeito a várias falhas de cross-site scripting (XSS). O cross-site scripting é um tipo de vulnerabilidade de segurança que permite que um invasor injete scripts maliciosos em um site, podendo levar ao acesso não autorizado ou ao controle das sessões dos usuários.

A vulnerabilidade permite que invasores falsifiquem mensagens syslog por meio de ataques de injeção de caracteres de nova linha.

Existe uma falha devido à forma como os cookies são tratados.

The issue allows a local attacker to conduct symlink attacks because it operates on full file system objects path names.

The issue is related to a cross-site scripting (XSS) vulnerability in error message contents. This type of vulnerability allows attackers to inject malicious scripts into content from otherwise trusted websites.

The issue arises from the way addslashes are used in SQL string escapes, potentially leading to unspecified security consequences.

The issue is related to cross-site scripting (XSS).

The issue allows local users to gain privileges through unspecified Trojan horse code in the current working directory due to an untrusted search path vulnerability in x11perfcomp.

The issue prevents Firefox plugins from determining if they should run in Private Browsing mode, allowing remote attackers to bypass intended access restrictions. This could be demonstrated using Flash, where the `NPNVprivateModeBool` variable settings are not properly provided.

The issue concerns a problem with privilege checking in libgssapi and libgssglue, which can be exploited locally. This can lead to the execution of arbitrary code via the `GSSAPI MECH CONF` environment variable. For example, this can be demonstrated using `mount.nfs`. The exploitation of this issue may result in a breach of confidentiality, integrity, and availability of protected information.

The issue concerns the generate admin password function, which uses time and PID values for seeding a random number generator. This makes it easier for local users to determine admin passwords via a brute-force attack.

The issue is related to a heap-based buffer overflow in the `Lookup MarkMarkPos` function in the HarfBuzz module (`harfbuzz-gpos.c`), which can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

The issue concerns multiple vulnerabilities in the libmodplug package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, a stack-based buffer overflow in the `CSoundFile::ReadS3M` function allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.

The issue is related to multiple vulnerabilities in the libmodplug package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, an off-by-one error in the `CSoundFile::ReadDSM` function in `src/load dms.cpp` allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.

The issue involves multiple race conditions in the mount.cifs and umount.cifs programs, allowing local users to cause a denial of service via a SIGKILL signal during a specific time window when the /etc/mtab~ file exists. This can lead to a mounting outage. The vulnerability can be exploited remotely, potentially disrupting confidentiality, integrity, and availability of protected information.

The issue allows context-dependent attackers to cause a denial of service or trigger a buffer overflow by providing an arbitrary value for a function argument. This is related to multiple files, including ext/curl/interface.c, ext/date/lib/parse date.c, ext/date/lib/parse iso intervals.c, ext/date/lib/parse tz.c, ext/date/lib/timelib.c, ext/pdo odbc/pdo odbc.c, ext/reflection/php reflection.c, ext/soap/php sdl.c, ext/xmlrpc/libxmlrpc/base64.c, TSRM/tsrm win32.c, and the strtotime function.

The issue involves multiple vulnerabilities in the gimp packages of CentOS and Red Hat Enterprise Linux operating systems. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information.