Adrian Gaitan

**Name of the Vulnerable Software and Affected Versions** NASA fprime-gds versions prior to 3.4.4 **Description** An unauthenticated remote attacker can achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in `src/fprime gds/flask/app.py` does not apply authentication to any endpoint. Additionally, a path traversal in `src/fprime gds/flask/updown.py` allows reading and writing arbitrary files outside the upload directory. The application also contains a hardcoded secret key, which enables session forgery. Chaining these issues allows for the complete compromise of the ground data system and any spacecraft under its control. **Recommendations** Update to version 3.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** FreePBX Framework version 17.0 **Description** A cross-site request forgery (CSRF) issue allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The '/admin/ajax.php' endpoint in `amp conf/htdocs/admin/libraries/BMO/Ajax.class.php` fails to implement CSRF tokens. The existing protection relies solely on a Referer header check, which can be bypassed if the request is sent without a Referer header or from a same-site context. This enables attackers to trigger administrative operations by luring an administrator to a malicious page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NASA HyperCP (main branch) **Description** An OS command injection issue exists where a network-adjacent attacker can execute arbitrary system commands on a researcher's workstation by intercepting or spoofing responses from the 'oceandata.sci.gsfc.nasa.gov' server. The `Source/OBPGSession.py` handler fails to sanitize server response headers and passes attacker-controlled field values to subprocess calls during data download operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.