Alemmi

An attacker can craft a URL that, when visited by an authenticated user, manipulates the backend to redirect the user to an arbitrary location. This issue occurs only if the victim's locale setting in Icinga Web is configured to a value other than `en US`.

An issue in the way the system loads theme translation files allows an authenticated Administrator to execute arbitrary code on the server by using a crafted theme.

Authenticated administrators can achieve remote code execution by abusing the theme translation file loading process. This occurs when an attacker with administrator privileges uploads a specially crafted theme containing malicious translation files, allowing the execution of arbitrary code on the server.

A vulnerability in Icinga Web 2 allows an attacker to craft a URL that, once visited by any user, enables the embedding of arbitrary Javascript into Icinga Web and allows the attacker to act on behalf of that user.

The issue affects the GLPI Agent, a generic management agent, when running the remoteinventory task against a Unix platform using the ssh command. An administrator user on the remote system can inject a command into a specific workflow that the agent runs with its privileges. If the agent is running with administration privileges, a malicious user could gain high privileges on the computer running the GLPI Agent. Additionally, a malicious user could disclose all remote accesses configured for the remoteinventory task.

The issue is related to insufficient cleaning of user data in the GLPI inventory endpoint, allowing an unauthenticated user to send a specially crafted request to the vulnerable application and execute arbitrary SQL commands in the application's database. This can enable a remote attacker to read, delete, or modify data in the database and gain full control over the vulnerable application. The GLPI inventory endpoint requires no authentication by default.

The issue is related to insufficient user data sanitization on search pages, allowing an attacker to craft a malicious link that can exploit a reflected XSS when opened by an authenticated user. This can lead to the execution of arbitrary HTML and script code in the user's browser, potentially allowing a remote attacker to steal confidential information, modify the webpage's appearance, or conduct phishing and drive-by download attacks.

The issue allows an attacker to inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Although the content security policy prevents loading scripts from most locations, `www.google-analytics.com` is allowed, which can be exploited using Google Tag Manager to inject arbitrary JavaScript and execute it on page load. Depending on the instance configuration, the attacker may not need authentication to create or edit notes.