Martin Prpič

A Denial of Service issue exists in the MONITOR Command Handler, allowing remote attackers to cause a system out-of-memory event.

The issue is related to Cross-Site Scripting (XSS) in key names.

The issue allows for XSS in the file attachment endpoint.

A permissions flaw was found, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.

The issue allows remote attackers to cause a denial of service, resulting in bandwidth consumption.

The issue is related to the lack of certificate verification when connecting via certain modules. Specifically, the `aliyun`, `proxmox`, and `splunk` modules do not verify certificates. This could potentially lead to security risks.

The issue allows local users to bypass authentication with X connections due to the lack of the -auth option when starting the X server.

The issue concerns the disclosure of sensitive information, specifically the ENGINE HTTPS PKI TRUST STORE PASSWORD, which is logged in the /var/log/ovirt-engine/engine.log file. This affects oVirt Engine in RHEV before version 4.0.

The issue allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name, due to improper processing of file names containing semicolons.

The issue is related to the scm plug-in in mock, which may allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file. This is due to insufficient access control, potentially enabling a remote attacker to exploit the weakness and obtain superuser privileges using a specially created file.

The issue allows local users to list running containers and possibly obtain sensitive information by running the machinectl command in oci-register-machine.

The issue allows remote attackers to cause a denial of service, resulting in memory consumption and a crash, by using a crafted tiff file.

A stack-based buffer overflow issue exists in the QXmlSimpleReader component, allowing remote attackers to cause an application crash by providing a specially crafted XML file containing multiple nested open tags.

The issue is caused by multiple stack-based buffer overflows that allow remote attackers to cause a denial-of-service. This can be achieved by writing a negative integer to the (1) cmd expand function, (2) cmd emboss function, or (3) cmd engrave function.

**Nome do software vulnerável e versões afetadas: Versões do MCabber anteriores à 1.0.4 Descrição: A vulnerabilidade permite que invasores remotos interceptem comunicações ou se adicionem como uma entidade na lista de contatos de terceiros, fingindo ser outro usuário, obtendo assim os privilégios associados, por meio de pacotes XMPP maliciosos. Isso é feito por meio de ataques de envio forçado à lista de contatos. Recomendações: Para versões anteriores à 1.0.4, atualize para a versão 1.0.4 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso às funções de gerenciamento da lista de contatos até que um patch seja aplicado. Evite usar pacotes XMPP manipulados nos pontos de extremidade da API afetados até que o problema seja resolvido.

The issue is related to a cross-site request forgery (CSRF) vulnerability in the pcsd web UI. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user is authenticated to.

The issue is related to a session fixation problem. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

A cross-site scripting (XSS) issue exists in the Shares overview of Openstack Manila, allowing remote authenticated users to inject arbitrary web script or HTML via the `Metadata` field in the "Create Share" form.

The issue concerns the client in MongoDB, where world-readable permissions are used on .dbshell history files. This could allow local users to obtain sensitive information by reading these files.

The issue allows local users to obtain sensitive database provisioning information. This is achieved by reading log files, specifically those generated by the ovirt-engine-provisiondb utility.