Michael Scherer

**Nome do software vulnerável e versões afetadas: Versões do Ipsilon de 0.1.0 a 1.0.0 Descrição: A configuração padrão do mecanismo de modelos Jinja no servidor do Provedor de Identidade (IdP) não habilita o auto-escaping, facilitando que invasores remotos realizem ataques de cross-site scripting (XSS) por meio de variáveis de modelo. Recomendações: Para as versões do Ipsilon 0.1.0 a 1.0.0, considere habilitar o auto-escaping na configuração do mecanismo de modelagem Jinja para mitigar o risco de ataques de cross-site scripting (XSS).

**Nome do software vulnerável e versões afetadas: Versões do Ipsilon de 0.1.0 a 1.0.0 Descrição: O problema decorre do fato de o servidor do Provedor de Identidade (IdP) não escapar corretamente certos caracteres em um modelo de mensagem de exceção do Python. Isso facilita que invasores remotos realizem ataques de cross-site scripting (XSS) por meio de uma resposta HTTP. Recomendações: Para as versões do Ipsilon 0.1.0 a 1.0.0, atualize para a versão 1.0.1 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas: Zimbra 2013 Descrição: A vulnerabilidade está relacionada a um problema de Cross-Site Scripting (XSS). Ela afeta o arquivo aspell.php. Recomendações: Para o Zimbra 2013, considere desativar o acesso ao arquivo aspell.php como uma solução temporária até que uma correção esteja disponível.

The issue concerns a predictable /tmp in the set-proxy connection hook of the OpenShift haproxy cartridge, which could facilitate a denial-of-service (DoS) attack.

The issue is related to the improper creation of files in /tmp by the dump.sh script in the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin directory of OpenShift.

The issue is related to insufficient input validation in Ansible, allowing an attacker to execute arbitrary code. Specifically, when running ad-hoc commands, inventory variables are loaded from the current working directory, which can be under an attacker's control. This can lead to the execution of arbitrary code.

The issue allows local users to have unspecified impact via a symlink attack on an unspecified file in /tmp. This is related to the oo-analytics-export and oo-analytics-import components in the openshift-origin-broker-util package.

The issue allows for file download over an insecure channel when performing a mirror update, potentially resulting in remote code execution.

The issue allows local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file. This is due to unspecified tests in the software.

The issue allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory. This is related to the hs.py component in OnionShare.

The issue allows local users to write to configuration files via a symlink attack on a temporary file. This is due to vulnerabilities in several functions, including ` write config`, `reset configuration`, `write config`, ` write mycnf`, `InnoBackupEx:: run prepare`, `InnoBackupEx::cmd`, `MySQLDump::cmd`, `InnoBackupExIncremental::cmd`, ` get actual db status`, and multiple class CbBackup methods.

The issue exists due to the failure to neutralize special elements in the get sdl function of the PHP interpreter. Exploitation of this issue may allow an attacker to disclose protected information, impact data integrity, or cause a denial of service. The default configuration of the soap.wsdl cache dir setting in PHP's configuration files specifies the /tmp directory, which facilitates local users' ability to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the `get sdl` function.

The issue arises from improper handling of files in /tmp by the `modules/chef.py` module in SaltStack.

The issue is related to the `modules/serverdensity device.py` module in SaltStack, which does not properly handle files in the `/tmp` directory. This can be exploited to gain unauthorized access to confidential data, cause a denial of service, or impact data integrity.

The issue allows remote attackers to execute arbitrary YAML code. The vendor has noted that this might not be considered a vulnerability because the YAML to be loaded has already been determined to be safe.

The issue allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/. This occurs when the playbook does not run due to an error.

The issue allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. This occurs when using ControlPersist in the `runner/connection plugins/ssh.py` module.

The issue allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by certain scripts, including tests/volume.rc and extras/hook-scripts/S30samba-stop.sh.

The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. This is due to the `diff pp` function in `lib/gauntlet rubyparser.rb`.