Arpit Jain

Reports generated by `plist-to-html`, `CodeChecker parse --export html`, and `CodeChecker cmd diff --output html` are susceptible to cross-site scripting. The software uses `json.dumps` to place the report message, checker name, and source file path into a script block. Because `json.dumps` does not escape the less-than character, a closing script tag in any of these fields can terminate the script element, allowing subsequent content to be parsed as HTML. This occurs when the report is published in an environment without a restrictive Content Security Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting.

An unauthenticated attacker can cause memory exhaustion and crash the node by sending an oversized request body via client-streaming or bidirectional-streaming. The issue occurs because the streaming read path in `Elixir.GRPC.Server.Adapters.Cowboy.Handler`:info/3 does not enforce the `max body size` limit, unlike the unary read path. Specifically, `Elixir.GRPC.Server.Adapters.Cowboy`:reading stream/1 appends received chunks to a buffer until a complete length-prefixed message is formed. By declaring a very large message and sending it through multiple small HTTP/2 DATA frames, an attacker can force the buffer to grow without limit, leading to a BEAM memory exhaustion and a complete node crash.

An issue exists where a verification code generated for one email-based workflow can be accepted by another sensitive workflow due to improper enforcement of the code purpose.

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user to add or replace cell comments on a sheet with protection enabled, including locked cells. Additionally, writing a comment to a non-existent cell will result in the creation of both the row and the cell.

An authenticated user with permissions to create Virtual Machine Instances (VMIs) can trigger a Denial of Service (DoS) by submitting a virtual machine definition containing an empty ephemeral volume. The `virt-controller` component does not properly validate the volume configuration, resulting in a nil-pointer dereference (an attempt to access a memory location that does not exist) and an application crash. Since the malformed definition remains in the cluster, the controller enters a continuous crash loop, which disrupts virtual machine lifecycle operations across the entire environment.

A flaw exists in the Ansible override values API of the foreman ansible plugin. The destroy action resolves the target LookupValue record by ID but fails to verify if the record belongs to an AnsibleVariable that the caller is authorized to edit. Consequently, an authenticated user possessing the `edit ansible variables` permission can delete any LookupValue by ID. This includes override values for Ansible variables outside their permission filter scope and override values associated with Puppet smart class parameters.

A flaw was found in the foreman remote execution plugin's template invocations controller. The show template invocation by host action resolves the job invocation by ID without evaluating the caller's view job invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

A flaw exists in the Ansible inventory API of the foreman ansible plugin. The controller utilizes an unscoped `Host.where()` call to build host queries, which fails to enforce the search filter linked to the caller's `view hosts` permission. Consequently, an authenticated user with restricted host visibility can provide arbitrary host IDs within their organization to retrieve the complete Ansible inventory for those hosts, including parameter values that are marked as hidden.

Connector configuration update and verification REST API methods fail to enforce authorization checks on referenced Assets and Secrets. While framework authorization is limited to write privileges on the Connector, an authenticated user with these privileges could apply Secret values from a Parameter Provider they are not authorized to read. Additionally, these methods accept Asset identifiers without verifying if the Asset belongs to the Connector being configured. This issue affects installations that implement different authorization levels across Connectors and Parameter Providers.

An improper check for certificate revocation exists where both OpenSSL and OpenSSL-FFM TLS implementations ignore Certificate Revocation Lists (CRLs)—lists of digital certificates that have been revoked by the issuing certificate authority before their scheduled expiration date—when a certificate uses a keystore.

An issue exists in the number scalar coercion for BigInteger that fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This leads to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, which results in a denial of service.

An issue exists where the template revision endpoint fails to enforce object-level authorization when retrieving an audited template revision. An authenticated user with low privileges and template-related permissions, such as `view ptables`, can access historical template contents from other organizations or locations by providing the relevant audit ID. This may lead to the unauthorized disclosure of sensitive data, including configuration details, credentials, or secrets. The REST API revision endpoints are not affected by this issue.

Spring MVC applications utilizing the functional web framework are susceptible to stream corruption when implementing Server-Sent Events (SSE), a mechanism that allows servers to push real-time updates to web pages over a single HTTP connection.

A flaw exists in the personal access token removal query where the system selects from `PersonalAccessTokenDB` but filters based on columns from `Session` without a proper join. SQLAlchemy interprets this as an implicit cross join, which fails to restrict the deletion process to the tokens belonging to the calling user. Consequently, an authenticated user can delete all personal access tokens across the entire system.

The user detail view of the extension does not verify if the requested user record matches the configured or logged-in target. This allows visitors with access to the Detail or List plugin to retrieve profile data of other frontend users, such as name, email, date of birth, and address, by providing an arbitrary `user ID`.

Reflected cross-site scripting (XSS) occurs when a strategy is configured with `require interaction?` set to true. The software serves intermediate HTML pages that embed request parameters directly into hidden input value attributes without HTML escaping. Specifically, the `confirm` parameter is interpolated in `lib/ash authentication/add ons/confirmation/confirmation form.html.eex` and the magic link token parameter is interpolated in `lib/ash authentication/strategies/magic link/sign in form.html.eex`. Because these templates use plain expressions that perform no escaping and the `accept/2` functions in `AshAuthentication.AddOn.Confirmation.Plug` and `AshAuthentication.Strategy.MagicLink.Plug` do not validate the values, an unauthenticated attacker can craft a URL to inject malicious markup. The injected script executes in the application origin, allowing access to cookies, sessions, and same-origin responses.

An over-read occurs in the `copy string tags()` function when processing zero-count ASCII EXIF entries. The function calculates the tag length as `entry->size - 1`; if `entry->size` is 0, the resulting length of -1 is passed to `i tags add()`, which triggers a `strlen()` call. This causes the system to scan past the entry until the next NUL character is found, potentially exposing adjacent heap bytes. This path is reachable via `im decode exif()` when using JPEG images or the Imager::File::WEBP distribution. An attacker can exploit this by providing a specially crafted image to `Imager->read()`, causing the `exif *` tag to contain sensitive heap data instead of an empty string.

The Import/Export Data functionality fails to properly neutralize special elements, which allows a remote attacker to execute arbitrary operating system commands on the server.