Carfeii

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out locally. The pull request to fix this issue awaits acceptance.

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

An issue exists in the `SAML.handleCallback()` function where it fails to consume RelayState, record assertion identifiers, or enforce `Response.InResponseTo`. In Service Provider (SP)-initiated flows, an attacker with a valid SAML response and matching RelayState can resubmit them to the `/recipe/saml/callback` endpoint before the assertion expires. In Identity Provider (IdP)-initiated flows, assertions can be replayed without RelayState. Additionally, the lack of `Response.InResponseTo` checks allows an active login to be completed using an assertion for a different identity and bypasses the `allowIDPInitiatedLogin=false` setting. The callback also fails to validate Destination or SubjectConfirmationData Recipient and NotOnOrAfter, resulting in the creation of a new authorization code for the captured user's identity.

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access. Upgrading to version 4.0.16 is recommended to address this issue. This patch is called d90f77314c7d4f2b53cf2425844bde2315bd26d2. Upgrading the affected component is advised.

A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation of the argument chapterId results in authorization bypass. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named b8134e774820e0971fa9d8074405b49a01c99bdc. It is suggested to install a patch to address this issue.

A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice ws handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.

A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice ws handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.

A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceImpl.getBookContentAbout of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Content Service. Such manipulation of the argument chapterId leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 966c4bdde3521dc0a165d15a2acff66ee33eaaa7. Applying a patch is advised to resolve this issue.

The `/{username}` web route accepted personal access tokens via HTTP Basic authentication without verifying their scope. This allowed tokens with unrelated scopes, such as `read:issue`, to access the owner's private activity through the profile activity tab and RSS/Atom feeds, as well as private organization activity via the organization feed. Additionally, public-only tokens could list private repositories, organizations, and render private profile READMEs. In the case of site administrator tokens, this access extended to every account.

A command injection issue exists in the `Entry::output()` function within the `television/channels/entry.rs` file. This occurs when the `raw` argument is manipulated, allowing an attacker with local access to execute arbitrary commands.

Remote manipulation of the `ip` argument within the `is global ip()` function in the mistralrs-server-core/src/media source.rs file allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location.

A remote path traversal issue exists in the `calibration apply()` function within the mistralrs-server-core/src/handlers.rs file. This occurs when the `save cimatrix` argument is manipulated, allowing an attacker to access or overwrite files outside the intended directory.

A flaw in the Path Exception Matcher component allows remote attackers to cause improper authorization. The issue exists within the `handleBasicAuth()` function located in the `mod/dynamicproxy/authProviders.go` file, where manipulation of the `PathPrefix` argument leads to the authorization failure.

Staff-level users can determine the relative ordering of hashed passwords belonging to other staff users. This issue does not directly disclose the password hashes or provide a practical method for password recovery.

An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is achieved by querying the Admin API to infer hash ordering, although the flaw does not directly expose the hashes or facilitate practical password recovery.

broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process using the `to string lossy()` call within `src/tree build/builder.rs` and the `TreeLine::unprune` function in `src/tree/tree line.rs`. A local user can create a file containing an escape sequence in its name, which is then written unmodified to the terminal of any user browsing that directory. This allows for the injection of OSC (Operating System Command) or CSI (Control Sequence Introducer) sequences, the impact of which depends on the terminal emulator being used. A proof of concept demonstrated the use of an OSC 52 sequence to write to the clipboard.

The software fails to neutralize control characters within the `version` field of a `package.json` file when rendering the package prompt segment. This allows an attacker to inject raw escape bytes into the version string, which results in the emission of arbitrary terminal control sequences every time the shell enters a directory containing the malicious file.

A security flaw exists in the Firmware Version Check component of the device. Remote manipulation of an unknown functionality within this component can lead to improper restriction of rendered UI layers. This attack is characterized by high complexity and is considered difficult to exploit.

An issue exists in the Bluetooth Low Energy Handler component where a manipulation can lead to weak password requirements. This attack requires local network access and is characterized by high complexity and difficult exploitability.