Ngo Wei Lin

**Nome do software vulnerável e versões afetadas** Microsoft SharePoint Server (versões afetadas não especificadas) **Descrição** Existe uma falha no Microsoft SharePoint Server que permite que invasores remotos executem código arbitrário e comprometam o sistema. O problema decorre de uma validação insuficiente de entradas. A exploração dessa falha poderia permitir que um invasor executasse código remotamente utilizando dados especialmente criados para esse fim. Trata-se de um problema de execução remota de código pós-autenticação. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns improper neutralisation of special characters, allowing command injection in the `main/lp/openoffice presentation.class.php` file. This enables users who are permitted to upload Learning Paths to obtain remote code execution. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the `main/lp/openoffice presentation.class.php` file or disabling the upload of Learning Paths until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns an unrestricted file upload in the `/main/inc/ajax/document.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution via unrestricted file uploads.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns an unrestricted file upload in the `/main/inc/ajax/dropbox.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the `/main/inc/ajax/dropbox.ajax.php` endpoint to prevent file uploads.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns an unrestricted file upload in the `/main/inc/ajax/exercise.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent remote code execution via unrestricted file uploads.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue allows authenticated attackers with a learner role to achieve remote code execution. This is possible due to an unrestricted file upload in the `/main/inc/ajax/work.ajax.php` endpoint, which enables the uploading of PHP files. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `/main/inc/ajax/work.ajax.php` endpoint to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.20 **Description** The issue concerns command injection in the `/main/webservices/additional webservices.php` endpoint, allowing unauthenticated attackers to achieve remote code execution due to improper neutralization of special characters. This is a bypass of a previously known issue. **Recommendations** For versions prior to 1.11.20, as a temporary workaround, consider restricting access to the `/main/webservices/additional webservices.php` endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.20 **Description** The issue concerns a path traversal vulnerability in the file upload functionality, specifically in the `/main/webservices/additional webservices.php` endpoint. This allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write. **Recommendations** For versions prior to 1.11.20, update to a version that contains a fix for this issue to prevent path traversal and subsequent remote code execution. As a temporary workaround, consider restricting access to the `/main/webservices/additional webservices.php` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.20 **Description** The issue is related to improper sanitisation in the `main/inc/lib/fileUpload.lib.php` file, which allows unauthenticated attackers to bypass file upload security protections. This can lead to remote code execution via the uploading of a `.htaccess` file. The vulnerability may be exploited by privileged attackers or chained with other vulnerabilities to achieve remote code execution. **Recommendations** For versions prior to 1.11.20, update to a version that contains a fix for this issue to prevent remote code execution. As a temporary workaround, consider restricting access to the `fileUpload.lib.php` file or disabling the file upload functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell, specifically through the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php`. This has been exploited in real-world incidents, such as the PermX machine on HackTheBox, where attackers used subdomain enumeration to discover a vulnerable Chamilo LMS instance, and then abused a bash script with sudo privileges to gain root access. **Recommendations** For versions prior to 1.11.24, update to version 1.11.24 or later to resolve the issue. As a temporary workaround, consider disabling the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` until a patch is available. Restrict access to the `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` file to minimize the risk of exploitation. Avoid using the big file upload functionality until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Chamilo LMS versions prior to 1.11.24 **Description** The issue concerns a command injection in the `main/lp/openoffice text document.class.php` file, allowing users who can upload Learning Paths to achieve remote code execution. This is due to the improper neutralization of special characters. **Recommendations** For versions prior to 1.11.24, update to a version that contains a fix for this issue to prevent command injection and potential remote code execution. As a temporary workaround, consider restricting the upload of Learning Paths to trusted users or disabling the vulnerable `openoffice text document.class.php` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NodeBB versions <= 2.8.10 **Description** The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively. **Recommendations** For NodeBB versions <= 2.8.10, update to a version greater than 2.8.10 to resolve the issue. As a temporary workaround, consider restricting the use of Socket.IO messages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Triangle MicroWorks SCADA Data Gateway (affected versions not specified) **Description** This issue allows remote attackers to create arbitrary files on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the processing of workspace files due to the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to create files in the context of Administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Versões do GitLab anteriores à 14.4.5 Versões do GitLab 14.5.0 a 14.5.3 Versões do GitLab 14.6.0 a 14.6.1 **Descrição** Foi descoberta uma falha no GitLab em que ele não ignora referências de substituição com subcomandos do git. Isso permite que um usuário mal-intencionado falsifique o conteúdo de seus commits na interface do usuário. **Recomendações** Para versões anteriores à 14.4.5, atualize para a versão 14.4.5 ou posterior. Para as versões 14.5.0 a 14.5.3, atualize para a versão 14.5.4 ou posterior. Para as versões 14.6.0 a 14.6.1, atualize para a versão 14.6.2 ou posterior.

**Nome do software vulnerável e versões afetadas** Hancom Office versão 9.6.1.7634 **Descrição** A vulnerabilidade permite um ataque do tipo “use-after-free” por meio de um arquivo .docx malicioso, afetando especificamente o componente tfo common no HwordApp.dll. **Recomendações** Para o Hancom Office versão 9.6.1.7634, no momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.