Bcoles

**Name of the Vulnerable Software and Affected Versions:** ProcessMaker versions prior to 3.5.4 **Description:** An unrestricted file upload vulnerability exists due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious `.tar` plugin file containing arbitrary PHP code. Upon installation, the plugin’s `install()` method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with a privilege escalation flaw to achieve full remote code execution from a low-privileged account. **Recommendations:** Update to version 3.5.4 or later.

Name of the Vulnerable Software and Affected Versions: VICIdial versions 2.9 RC1 through 2.13 RC1 Description: An unauthenticated command injection issue exists in the `vicidial sales viewer.php` component when password encryption is enabled. The application improperly passes the HTTP Basic Authentication password to a call to `exec()` without adequate sanitation, allowing remote attackers to inject and execute arbitrary operating system commands as the web server user. Recommendations: VICIdial versions 2.9 RC1 through 2.13 RC1: Disable password encryption to mitigate the issue.

Name of the Vulnerable Software and Affected Versions: HashiCorp Vagrant (affected versions not specified) Description: An authenticated virtual machine escape issue exists in HashiCorp Vagrant when using the default synced folder configuration. This configuration automatically mounts the host system's project directory into the guest VM, including the Vagrantfile configuration file, which is a Ruby script evaluated by the host. A low-privileged attacker with shell access to the guest VM can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host runs a vagrant command, the injected code is executed on the host with that user's privileges. This enables guest-to-host code execution in multi-tenant or adversarial VM scenarios. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Metasploit Framework (affected versions not specified) **Description** The issue concerns a relative path traversal vulnerability in the get keychains method of the "post/osx/gather/enum osx module" module. This vulnerability can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Metasploit Framework (affected versions not specified) **Description** The issue concerns a relative path traversal vulnerability in the untar method of the "auxiliary/admin/http/telpho10 credential dump" module. This vulnerability can be exploited to write arbitrary files to arbitrary locations on the host file system when the module is run on a malicious HTTP server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** festivaltts4r gem for Ruby (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) `to speech` or (2) `to mp3` method in `lib/festivaltts4r/festival4r.rb`. This can lead to unauthorized access and control of the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.