Gjoko Krstic

Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash the app. Attackers can send a crafted GIF with zero dimensions that triggers an uncaught NSInternalInconsistencyException, aborting the app with SIGABRT when opened.

** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP (Jabber) server library. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

LDAPCache and LDAPBackingEngine build LDAP search filters for user and role lookups by substituting placeholders `%u`, `%dn`, and `%fqdn` into administrator-configured filter templates `userFilter` and `roleFilter`. The software fails to properly escape characters required by RFC 4515, specifically `*`, `(`, `)`, and `NUL`. A crafted login name containing these characters can alter the structure of the resulting filter, potentially turning an equality match into a wildcard match or closing and reopening filter clauses. This can lead to the search returning unintended LDAP entries, resulting in over-granted roles or affecting which account a login resolves to. This issue is specifically reproducible through the `GSSAPILdapLoginModule` via the `NameCallback` name and through the `LDAPBackingEngine` `listRoles()` function using `principal.getName()`, as these paths do not apply prior escaping.

An improper link resolution issue exists in the `tar` source plugin when running on Python versions prior to 3.12. This allows malicious source tarballs to write files on the host system with the privileges of the user running BuildStream by using symlinks during the source fetching process. Symlinks are symbolic links, which are files that point to another file or directory.

Multiple data race conditions exist in the `ftpserv.c` file. An unauthenticated anonymous attacker can trigger undefined behavior by sending a LIST command followed by an ABOR command. This occurs because the control thread closes the `data socket` and `file fd` descriptors while worker threads are simultaneously accessing these same fields within the `worker thread cleanup()` function. Consequently, the operating system may reassign these stale file descriptors, which worker threads might then use on unrelated resources, potentially leading to a denial of service.

A race condition exists in the `worker thread cleanup()` function of ftpserv.c. This occurs when remote unauthenticated attackers trigger unsynchronized access to shared per-connection state without the required mutex lock. By sending a data-transfer command like LIST followed immediately by ABOR, an attacker can exploit missing synchronization on shared context and detached thread id reuse. This leads to daemon destabilization or a crash, resulting in a denial of service.

The firmware uses a weak single-byte XOR cipher with a static key to obfuscate the configuration backup file. This allows unauthenticated attackers to reverse the cipher and recover stored secrets in plaintext from the `Router.cfg` backup file. Exposed information includes web administration and telnet passwords, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers such as `IMSI` and `IMEI`.

A server-side request forgery (SSRF) issue exists when the optional Node-RED plugin is installed. Unauthenticated attackers can force the device to issue arbitrary blind HTTP requests to internal or external hosts by providing a malicious callback URL. This is possible due to a lack of destination validation and the use of the default passphrase `opendoor`.

A mass assignment flaw allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. This enables the manipulation of sensitive values such as the `passphrase` and `listening port`. Additionally, the absence of adequate request validation allows these actions to be performed via cross-site request forgery, a technique where a user is tricked into executing unwanted actions on a web application in which they are currently authenticated.

An issue exists in the optional `cli control` plugin that allows unauthenticated attackers or those using cross-site request forgery to execute arbitrary operating-system commands. This is achieved by storing a malicious payload via the plugin's HTTP endpoint. Execution is triggered when the associated irrigation station is activated, exploiting the lack of passphrase protection or the use of the default passphrase `opendoor` to run commands on the host.

The Honeywell IQ4x building management controller exposes its full web-based Human Machine Interface (HMI) without authentication in its factory-default configuration. When no user module is configured, security is disabled by design, and the system operates under a System Guest context, granting read/write privileges to anyone who can access the HTTP interface. Authentication is only enforced after a web user is created through the `U.htm` function, which dynamically enables the user module. Because this function is accessible before authentication, a remote user can create a new account with administrative read/write permissions, enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively prevent legitimate operators from accessing local and web-based configuration and administration.

The firmware on Tattile Smart+, Vega, and Basic device families, versions 1.181.5 and earlier, allows unauthorized access to Real Time Streaming Protocol (RTSP) streams. An attacker can connect to the RTSP service without providing valid credentials and access live video and audio feeds, leading to the disclosure of surveillance data.

The device families ship with default credentials that are not required to be changed during setup. An attacker reaching the management interface can use these default credentials to gain administrative access, potentially allowing unauthorized access to device configuration and data.

The affected devices implement an authentication token (`X-User-Token`) with insufficient expiration. An attacker who obtains a valid token, for example through interception, log exposure, or token reuse on a shared system, can continue to authenticate to the management interface until the token is revoked. This enables unauthorized access to device functions and data.

The eNet SMART HOME server is affected by a privilege escalation issue. Insufficient authorization checks within the `setUserGroup` JSON-RPC method allow a low-privileged user (UG USER) to elevate their account to the UG ADMIN group. This is achieved by sending a crafted POST request to the `/jsonrpc/management` API endpoint, specifying the user's own username. Successful exploitation grants administrative capabilities, including the ability to modify device configurations and network settings.

The eNet SMART HOME server is affected by a default credentials issue. The server ships with default credentials ('user:user', 'admin:admin') that remain active after installation and commissioning without requiring a password change. This allows unauthenticated attackers to gain administrative access to sensitive smart home configuration and control functions.

The eNet SMART HOME server software has a flaw where authorization checks are absent in the `deleteUserAccount` JSON-RPC method. This allows a standard, authenticated user (UG USER) to remove other user accounts, with the exception of the built-in admin account. The application fails to implement role-based access control for this function. An attacker can send a specially crafted POST request to the `/jsonrpc/management` API endpoint, specifying a `username` to be deleted, without needing higher privileges or further confirmation. The vulnerable parameter is `username`.

The software contains a missing authorization flaw in the `resetUserPassword` JSON-RPC method. An authenticated, low-privileged user (UG USER) can reset the passwords of any account, including those with UG ADMIN and UG SUPER ADMIN privileges, without knowing the current password. This is achieved by sending a specially crafted JSON-RPC request to the `/jsonrpc/management` API endpoint. Successful exploitation allows an attacker to overwrite existing credentials, leading to account takeover and full administrative access with persistent privilege escalation.

JUNG Smart Visu Server version 1.1.1050 contains a request header manipulation issue that allows unauthenticated attackers to override request URLs by injecting arbitrary values into the `X-Forwarded-Host` header. Attackers can manipulate proxied requests to generate tainted responses, potentially leading to cache poisoning, phishing, and redirection of users to malicious domains. The vulnerability involves improper neutralization of HTTP headers for scripting syntax.