Ngo Wei Lin

Existe uma falha no Microsoft SharePoint Server que permite que invasores remotos executem código arbitrário e comprometam o sistema. O problema decorre de uma validação insuficiente de entradas. A exploração dessa falha poderia permitir que um invasor executasse código remotamente utilizando dados especialmente criados para esse fim. Trata-se de um problema de execução remota de código pós-autenticação.

The issue concerns improper neutralisation of special characters, allowing command injection in the `main/lp/openoffice presentation.class.php` file. This enables users who are permitted to upload Learning Paths to obtain remote code execution.

The issue concerns an unrestricted file upload in the `/main/inc/ajax/document.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files.

The issue concerns an unrestricted file upload in the `/main/inc/ajax/dropbox.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files.

The issue concerns an unrestricted file upload in the `/main/inc/ajax/exercise.ajax.php` endpoint, allowing authenticated attackers with a learner role to achieve remote code execution by uploading PHP files.

The issue allows authenticated attackers with a learner role to achieve remote code execution. This is possible due to an unrestricted file upload in the `/main/inc/ajax/work.ajax.php` endpoint, which enables the uploading of PHP files.

The issue concerns command injection in the `/main/webservices/additional webservices.php` endpoint, allowing unauthenticated attackers to achieve remote code execution due to improper neutralization of special characters. This is a bypass of a previously known issue.

The issue concerns a path traversal vulnerability in the file upload functionality, specifically in the `/main/webservices/additional webservices.php` endpoint. This allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.

The issue is related to improper sanitisation in the `main/inc/lib/fileUpload.lib.php` file, which allows unauthenticated attackers to bypass file upload security protections. This can lead to remote code execution via the uploading of a `.htaccess` file. The vulnerability may be exploited by privileged attackers or chained with other vulnerabilities to achieve remote code execution.

The issue allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell, specifically through the big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php`. This has been exploited in real-world incidents, such as the PermX machine on HackTheBox, where attackers used subdomain enumeration to discover a vulnerable Chamilo LMS instance, and then abused a bash script with sudo privileges to gain root access.

The issue concerns a command injection in the `main/lp/openoffice text document.class.php` file, allowing users who can upload Learning Paths to achieve remote code execution. This is due to the improper neutralization of special characters.

The issue allows unauthenticated attackers to trigger a crash in NodeBB when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name respectively.

This issue allows remote attackers to create arbitrary files on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the processing of workspace files due to the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this to create files in the context of Administrator.

Foi descoberta uma falha no GitLab em que ele não ignora referências de substituição com subcomandos do git. Isso permite que um usuário mal-intencionado falsifique o conteúdo de seus commits na interface do usuário.

A vulnerabilidade permite um ataque do tipo “use-after-free” por meio de um arquivo .docx malicioso, afetando especificamente o componente tfo common no HwordApp.dll.