Evilaliv3

Hush Line is an open-source whistleblower management system. The production server was misconfigured, missing content security policy and security headers, which could result in bypassing of cross-site scripting filters.

The issue allows a stored XSS via a crafted whistleblower entry.

The issue concerns multiple directory traversal vulnerabilities in the return application language function. These vulnerabilities allow remote attackers to include and execute arbitrary local files. This can be achieved by providing a .. (dot dot) in specific parameters, such as the `lang crm` parameter to "phprint.php" or the `current language` parameter in an Accounts Import action to "graph.php".

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue arises from Varnish writing data to a log file without sanitizing non-printable characters. This could potentially allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. The vendor disputes the significance of this report, stating that the real problem lies in the mistaken belief that one can safely use the `cat(1)` command on a random log file to their terminal.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as mini httpd writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. This is due to thttpd writing data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as WEBrick writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as Yaws writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This occurs because the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This is related to the handling of specific parameters and headers, including the `Age` parameter in the Cookie Dump Servlet, the `A` parameter in jsp/expr.jsp, and the `Content-Length` HTTP header.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This is because nginx writes data to a log file without sanitizing non-printable characters.

The issue concerns the saveForwardAttachments procedure in the Compose Mail functionality, allowing remote authenticated users to execute arbitrary code. This can be achieved by composing an e-mail message with a specifically crafted attachment filename and then making a direct request to a certain pathname under storage/. The vulnerability can be exploited in installations based on certain Apache HTTP Server configurations, and the attachment filename can end in .php, .php., or .php/ on different operating systems.

A cross-site scripting (XSS) issue exists in the Activities module, allowing remote attackers to inject arbitrary web script or HTML via the `action` parameter to "phprint.php".

A cross-site request forgery issue exists in the RSS module, allowing remote attackers to hijack Admin user authentication for modifying the news feed system. This is achieved via the `rssurl` parameter in a Save action to "index.php".

The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the `module` parameter to "graph.php", or the `module` or `file` parameter to "include/Ajax/CommonAjax.php", which can be reached through various modules such as "modules/Campaigns/CampaignsAjax.php", "modules/SalesOrder/SalesOrderAjax.php", and others. Additionally, remote authenticated users can include and execute arbitrary local files via a .. (dot dot) in the `step` parameter in an Import action to certain modules, including Accounts, Contacts, HelpDesk, Leads, Potentials, Products, or Vendors, reachable through "index.php" and related to "modules/Import/index.php" and multiple "Import.php" files.

Name of the Vulnerable Software and Affected Versions: Collabtive version 0.4.8 Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type, then accessing it via a direct request to the file in files/. This is related to the showproject action in managefile.php or the Messages feature. Recommendations: For Collabtive version 0.4.8, consider restricting file uploads to only allow non-executable file types and validate the MIME type of uploaded files to prevent exploitation. As a temporary workaround, restrict access to the files/ directory to minimize the risk of code execution.

Name of the Vulnerable Software and Affected Versions: Collabtive version 0.4.8 Description: The issue allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to "admin.php". Recommendations: For Collabtive version 0.4.8, consider restricting access to the "admin.php" endpoint until a patch is available. As a temporary workaround, limit the ability to create new users, especially administrators, to minimize the risk of exploitation.