Brendan Scarvell

Authenticated attackers can execute arbitrary commands as root by injecting shell metacharacters into the `username` JSON parameter. This occurs because the `dalStorage addUserAccount()` function unsafely concatenates user-supplied input into a shell command string passed to `rut doSystemAction()` without proper sanitization, leading to full root-level command execution on the operating system.

An authentication bypass exists in the web management interface due to a hardcoded AES-256 key used to encrypt session cookies. An unauthenticated attacker can use this shared key to forge a valid encrypted session cookie and gain full administrative control of the interface, provided a legitimate administrator session is active.

The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.

The issue allows command line arguments to be injected during Firefox invocation as a shell handler for certain unsupported file types. This requires Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third-party application that insufficiently sanitizes URL data. In such a situation, clicking a link in the third-party application could be used to retrieve and execute files whose location was supplied through command line arguments. This issue only affects Windows operating systems when Firefox is configured as the default handler for non-default file types.

Name of the Vulnerable Software and Affected Versions: Electron versions 1.7 up to 1.7.12 Electron versions 1.8 up to 1.8.3 Electron versions 2.0.0 up to 2.0.0-beta.3 Description: The issue is related to an improper handling of values in Webviews, which can result in remote code execution. This can be exploited via an app that allows execution of 3rd party code, disallows node integration, and has not specified if webview is enabled or disabled. The application must also meet specific conditions, including running on affected Electron versions, allowing execution of arbitrary remote code, disabling Node.js integration, and not explicitly declaring webviewTag as false. Recommendations: For Electron versions 1.7 up to 1.7.12, update to version 1.7.13 or later. For Electron versions 1.8 up to 1.8.3, update to version 1.8.4 or later. For Electron versions 2.0.0 up to 2.0.0-beta.3, update to version 2.0.0-beta.5 or later. If an update is not possible, mitigate the vulnerability by using the provided code to disable node integration and webviewTag in webPreferences, and prevent new-window events from overriding event.newGuest without using the supplied options tag. Additionally, consider preventing the attachment of webviews if they are not used.