Stefan Schiller

A falha permite a gravação arbitrária de arquivos como o usuário OSV-SCALIBR no sistema host por meio de uma vulnerabilidade de path traversal ao utilizar a função unpack() do OSV-SCALIBR para imagens de container. Isso é particularmente problemático ao utilizar a flag de CLI --remote-image em imagens de container não confiáveis.

Nome do software vulnerável e versões afetadas: Wyze Cam v3 (versões afetadas não especificadas) Descrição: Esta vulnerabilidade permite que invasores fisicamente presentes executem código arbitrário em instalações afetadas das câmeras IP Wyze Cam v3. A falha específica está relacionada ao tratamento de SSIDs incorporados em códigos QR escaneados, resultante da falta de validação adequada de uma string fornecida pelo usuário antes de usá-la para executar uma chamada de sistema. Um invasor pode explorar essa vulnerabilidade para executar código no contexto de root. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

Inadequate content filtering in Joomla leads to multiple XSS vulnerabilities in various components. Attackers can trick administrators into clicking on a malicious link, potentially granting them full control of the website and allowing for remote code execution (RCE). The issue is estimated to affect over 2.7 million services, mainly distributed in the United States, Germany, and other countries.

The issue allows project administrators to import attachments with unrestricted URL values, potentially causing Apache Allura to read local files and expose them. This exposure can lead to other exploits, such as session hijacking or remote code execution.

The issue arises from incorrect calculations of instruction element lengths during the Guacamole protocol handshake. This could allow an attacker to inject Guacamole instructions through specially-crafted data.

The issue allows an attacker to execute arbitrary code with the privileges of the guacd process, depending on timing, as Apache Guacamole may continue to reference a freed RDP audio input buffer.

The issue allows an attacker with access to certain private information to impersonate other users.

The issue allows an attacker with admin account access to perform remote code execution (RCE) via null-byte injection.

The issue is related to insufficient comparison in the Apache OpenMeetings video conferencing software. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information.

The issue allows path traversal in HTML export, a non-default feature. Organizers can trigger the overwriting of an arbitrary file with the standard pretalx 404 page content.

The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files.

The issue is related to unauthenticated, stored cross-site scripting in the display of alarm reduction keys, which could allow an attacker to access confidential session information. This is due to inadequate protection of the web page structure. The exploitation of this issue may enable a remote attacker to gain unauthorized access to protected session information.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. The specific flaw exists within a shared library used by the telnetd service, which listens on TCP port 23 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

The issue allows an attacker to inject and execute PHP code in the `auth.php` and `hosttags.php` files of the watolib component, which will be executed upon request of the vulnerable component.

The issue allows an attacker to perform a limited Server-Side Request Forgery (SSRF) in the agent-receiver component, enabling communication with local network restricted endpoints through the host registration API.

The issue allows an attacker to perform direct queries to the application's core from localhost by injecting Livestatus Query Language (LQL) in the AuthUser HTTP query header.

Uma vulnerabilidade de string de formato permite que invasores remotos, com a ajuda do usuário, executem código por meio de um arquivo de lista de reprodução m3u especialmente criado.