Giovanni Pellerano

The issue allows a stored XSS via a crafted whistleblower entry.

The issue concerns multiple directory traversal vulnerabilities in the return application language function. These vulnerabilities allow remote attackers to include and execute arbitrary local files. This can be achieved by providing a .. (dot dot) in specific parameters, such as the `lang crm` parameter to "phprint.php" or the `current language` parameter in an Accounts Import action to "graph.php".

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue arises from Varnish writing data to a log file without sanitizing non-printable characters. This could potentially allow remote attackers to modify a window's title or possibly execute arbitrary commands or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. The vendor disputes the significance of this report, stating that the real problem lies in the mistaken belief that one can safely use the `cat(1)` command on a random log file to their terminal.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as mini httpd writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. This is due to thttpd writing data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as WEBrick writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as Yaws writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This occurs because the software writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This is related to the handling of specific parameters and headers, including the `Age` parameter in the Cookie Dump Servlet, the `A` parameter in jsp/expr.jsp, and the `Content-Length` HTTP header.

The issue allows remote attackers to potentially modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator. This is because nginx writes data to a log file without sanitizing non-printable characters.

The issue allows remote attackers to include and execute arbitrary local files via directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the `module` parameter to "graph.php", or the `module` or `file` parameter to "include/Ajax/CommonAjax.php", which can be reached through various modules such as "modules/Campaigns/CampaignsAjax.php", "modules/SalesOrder/SalesOrderAjax.php", and others. Additionally, remote authenticated users can include and execute arbitrary local files via a .. (dot dot) in the `step` parameter in an Import action to certain modules, including Accounts, Contacts, HelpDesk, Leads, Potentials, Products, or Vendors, reachable through "index.php" and related to "modules/Import/index.php" and multiple "Import.php" files.

The issue concerns the saveForwardAttachments procedure in the Compose Mail functionality, allowing remote authenticated users to execute arbitrary code. This can be achieved by composing an e-mail message with a specifically crafted attachment filename and then making a direct request to a certain pathname under storage/. The vulnerability can be exploited in installations based on certain Apache HTTP Server configurations, and the attachment filename can end in .php, .php., or .php/ on different operating systems.

A cross-site scripting (XSS) issue exists in the Activities module, allowing remote attackers to inject arbitrary web script or HTML via the `action` parameter to "phprint.php".

A cross-site request forgery issue exists in the RSS module, allowing remote attackers to hijack Admin user authentication for modifying the news feed system. This is achieved via the `rssurl` parameter in a Save action to "index.php".

Name of the Vulnerable Software and Affected Versions: Collabtive version 0.4.8 Description: A cross-site scripting (XSS) issue exists due to improper handling of user input in the project Name field when an administrator performs an editform action. This allows attackers to inject arbitrary web script or HTML. Recommendations: For Collabtive version 0.4.8, consider restricting access to the manageproject.php file until a proper fix is applied, and ensure that all user input is properly sanitized to prevent XSS attacks. As a temporary workaround, avoid using the project Name field in manageproject.php for any sensitive operations.

Name of the Vulnerable Software and Affected Versions: Collabtive version 0.4.8 Description: The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for various requests, including submitting or editing a new project, uploading files to a project, or attaching files to messages. It is noted that these issues can be leveraged with other vulnerabilities to create remote attack vectors that do not require authentication. Recommendations: For Collabtive version 0.4.8, as a temporary workaround, consider implementing strict validation and verification of requests to prevent unauthorized actions, such as submitting or editing projects, uploading files, or attaching files to messages, until a patch is available. Restrict access to sensitive project management and file upload functionalities to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Collabtive version 0.4.8 Description: The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and using a text/plain MIME type, then accessing it via a direct request to the file in files/. This is related to the showproject action in managefile.php or the Messages feature. Recommendations: For Collabtive version 0.4.8, consider restricting file uploads to only allow non-executable file types and validate the MIME type of uploaded files to prevent exploitation. As a temporary workaround, restrict access to the files/ directory to minimize the risk of code execution.