Ghost

A server-side template injection occurs in the Twig theme rendering sandbox. The sandbox, designed to restrict user-uploaded theme templates, fails to fully enforce restrictions, allowing a crafted template to escape. An authenticated user with the `core:themes:create` permission can upload a malicious theme that, when rendered, enables arbitrary code execution with the privileges of the web server process. This allows for the execution of operating system commands, reading of server-side files such as configuration files and database credentials, writing files, and accessing internal services.

The issue is related to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability, which allows Object Injection in Drupal core.

A misaligned address was discovered in the robdns commit d76d2e6 at the `/src/zonefile-insertion.c` location.

A misaligned address was discovered at smartdns/src/dns.c in smartdns commit 54b4dc.

A heap overflow was discovered in robdns via the component `block->filename` at `/src/zonefile-insertion.c`.

A misaligned address was discovered at smartdns/src/util.c in smartdns commit 54b4dc.

The issue allows for a timing attack against the `validateToken` function due to a string comparison that stops at the first different character. This enables attackers to guess tokens through brute force, one character at a time, by observing the timing. The search space is reduced to a linear amount of guesses based on the token length times the possible characters.

A heap-based buffer overflow issue was found in ImageMagick's `PushCharPixel()` function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read error and allowing an application to crash, resulting in a denial of service.

A reflected cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML by exploiting the zero parameter.

The issue is related to incorrect access control in the component "/index.php?mod=system&op=orgtree" of dzzoffice, allowing unauthenticated attackers to browse departments and usernames.

A Cross Site Request Forgery issue allows an attacker to gain privileges via the `adduser` function of "index.php".

A flaw was found in the create section from phdr function, which allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, leading to memory corruption and possibly code execution through the binary object's callback function.

The issue arises from a lack of validation on user input data during the login process. This allows parameters passed from the front end to the back end to be controlled, leading to SQL injection.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo delete mask` function in `jocms/apps/mask/mask.php`.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo json check` function in `jocms/apps/mask/inc/getmask.php`.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo json check()` function in `jocms/apps/mask/inc/mask.php`.

The issue allows remote attackers to execute arbitrary SQL commands and view sensitive information. This is achieved via the `jo set mask()` function in `jocms/apps/mask/mask.php`.

The issue allows attackers to run arbitrary code via a crafted image upload, exploiting a File Upload vulnerability.

The issue allows attackers to run arbitrary code via the `user name` field of the "/login" API endpoint. This is a Cross Site Scripting (XSS) issue, which means attackers can inject malicious scripts into the website, potentially leading to unauthorized access or control.

The issue allows absolute path traversal due to the unsafe use of the Flask send file function.