Govulnbot

The issue concerns Traefik, an HTTP reverse proxy and load balancer, where a potential vulnerability exists in managing requests using a PathPrefix, Path, or PathRegex matcher. When Traefik is configured to route requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it is possible to target a backend exposed using another router, bypassing the middlewares chain.

The issue arises when using AppArmor for enforcement of sandbox permissions in snapd. It failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker could convince a user to install a malicious snap that uses the 'home' plug, allowing them to install arbitrary scripts into the users PATH. These scripts may then be run by the user outside of the expected snap sandbox, enabling them to escape confinement.

The issue arises from the mishandling of a wildcard at the end of an origin string by the `parseWildcardRules` function in Gin-Gonic CORS middleware. This results in unintended origins being allowed. For example, `https://example.community/*` is allowed when the intention is to only allow `https://example.com/*`, and `http://localhost.example.com/*` is allowed when the intention is to only allow `http://localhost/*`.

The issue is related to the `extractFromZipFile()` function in `model.go` of the Ollama system, which is used for launching and managing large language models (LLM). This function has an incorrect restriction on the directory path name with limited access. Exploitation of this issue may allow a remote attacker to impact the confidentiality and integrity of protected information. The `extractFromZipFile` function can extract members of a ZIP archive outside of the parent directory.

This issue is related to a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint used to export data from running emulators. If a user is running the emulator and navigates to a malicious website with the exploit on a browser that allows calls to localhost, the website could exfiltrate emulator data.

The issue is related to information disclosure via caching in the coredns DNS server. It could allow a remote attacker to conduct spoofing attacks due to incorrectly implemented caching, leading to invalid cache entries being returned.

The issue allows a remote attacker to execute arbitrary code via the unsafe concatenation of the `filename` argument into the `buildStr` string without any sanitization or filtering. A remote attacker can also execute arbitrary commands via crafted HTTP requests. The BuildClient function within client service.go is also vulnerable.

The issue allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.

The issue is related to a lack of error handling in the TCP server in Google's gRPC, which allows an attacker to cause a denial of service by initiating a significant number of connections with the server. This affects gRPC C++, Python, and Ruby, but does not affect gRPC Java and Go. The issue is present on posix-compatible platforms, such as Linux.

The issue allows remote attackers to cause a denial of service via the `PageWriter.write` function in `pagewriter.go`. The vendor's position is that this is not a vulnerability.

A HTTP response header injection issue allows attackers to execute arbitrary code via supplying a crafted URL.

The issue allows for XSS because redirection can occur for some protocols outside of the trusted set of three, which includes `vscode:`, `vscode-insiders:`, and `jetbrains-gateway:`.

The issue is related to the `gettext()` function in Git for Windows, which uses a hard-coded path to look for localized messages. This allows low-privilege users to place fake messages in a specific location, potentially leading to social engineering attacks. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website. The attack vector is less likely due to the requirement of local write access by the attacker.

The issue allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials due to the lack of restriction on the Origin header. This can lead to the extraction of data from workspaces or a full takeover of the workspace.

A vulnerability was found in OpenShift OSIN, classified as problematic. It affects the function `ClientSecretMatches/CheckClientSecret`. The manipulation of the argument `secret` leads to observable timing discrepancy, making it vulnerable to timing attacks. This could permit an attacker to determine client secrets.

A vulnerability was found in docconv, classified as problematic, affecting the function `ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText`. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely.

A vulnerability was found in the destiny.gg chat, affecting the function `websocket.Upgrader` of the file main.go. The manipulation leads to cross-site request forgery, and the attack may be initiated remotely.

A problematic vulnerability was found in studygolang, affecting the `Search` function of the file `http/controller/search.go`. The manipulation of the argument `q` leads to cross-site scripting. The attack can be initiated remotely.

A critical issue affects the function ConvertPDFImages of the file pdf ocr.go. The manipulation of the argument `path` leads to os command injection. The attack can be initiated remotely.

The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network are impacted. The authentication token used to communicate with the Synthetic Monitoring API is exposed through a debugging endpoint. This token can be used to retrieve the Synthetic Monitoring checks created by the user and assigned to the agent identified with that token. The Synthetic Monitoring API will reject connections from already-connected agents, so access to the token does not guarantee access to the checks.