Jakaba

**Name of the Vulnerable Software and Affected Versions** Ollama versions prior to 0.1.34 **Description** Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code execution (RCE). Exploitation involved overwriting `/etc/ld.so.preload` to load a malicious shared library, escalating from arbitrary file write to remote code execution. Over 1,000 instances were found to be exposed. The issue occurs because Ollama does not validate the format of the digest (SHA256 with 64 hexadecimal digits) when obtaining the model path, mishandling cases with fewer or more than 64 digits, or when the path begins with a `../` substring. **Recommendations** Versions prior to 0.1.34 should be updated to version 0.1.34 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Bit versions 2.0.7 through 3.0.3 **Description** A memory corruption vulnerability in Fluent Bit's embedded HTTP server allows an unauthenticated attacker to potentially execute arbitrary code, cause a denial of service, or disclose sensitive information. The issue is related to a heap buffer overflow when parsing trace requests. With over 13 billion downloads, Fluent Bit is widely used in major cloud platforms and by tech giants, making this vulnerability particularly concerning. While creating a reliable exploit for remote code execution may be challenging, a proof of concept for denial of service is already publicly available. **Recommendations** For Fluent Bit versions 2.0.7 through 3.0.3, upgrade to version 3.0.4 or later to mitigate the vulnerability. As a temporary workaround, consider restricting access to the API endpoint `/api/v1/traces endpoint` or disabling it altogether to prevent potential attacks. Limiting access to the vulnerable endpoint to authorized users and services can also help mitigate the issue until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Apache HugeGraph-Server versions 1.0.0 through 1.3.0 Description: The issue affects Apache HugeGraph-Server, allowing unauthenticated remote code execution and server takeover. This flaw can be exploited by attackers to bypass sandbox restrictions, leading to remote code execution. The vulnerability has been identified in HugeGraph-Server versions 1.0.0 – 1.3.0. It is recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. The vulnerability is being actively exploited, and users are advised to take immediate action to prevent exploitation. Recommendations: Upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. As a temporary workaround, consider disabling the vulnerable `groovy` injection functionality until a patch is available. Restrict access to the vulnerable `gremlin` endpoint to minimize the risk of exploitation. Avoid using the `groovy` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Issabel PBX version 4.0.0 **Description** A critical issue affects the processing of the file /index.php?menu=asterisk cli of the component Asterisk-Cli. The manipulation of the argument `Command` leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Issabel PBX version 4.0.0, as a temporary workaround, consider disabling the `Command` argument in the /index.php?menu=asterisk cli file until a patch is available. Restrict access to the Asterisk-Cli component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions 2.4-milestone-1 through 4.10.20 XWiki Platform versions 15.5.4 and earlier XWiki Platform versions 15.10-rc-1 and earlier **Description** The issue in XWiki Platform stems from a lack of input validation within the database search functionality. This allows a non-authenticated attacker to achieve remote code execution. The database search is accessible by default to all users, meaning any visitor to a public wiki or user of a closed wiki could potentially exploit this issue, impacting the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability allows execution of arbitrary code through the search text. The API endpoint involved is `/xwiki/bin/get/Main/DatabaseSearch`. The vulnerable parameter is `text`. **Recommendations** XWiki Platform versions 2.4-milestone-1 through 4.10.20: Manually apply the patch to the `Main.DatabaseSearch` page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.5.4 and earlier: Manually apply the patch to the `Main.DatabaseSearch` page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.10-rc-1 and earlier: Manually apply the patch to the `Main.DatabaseSearch` page, or delete the page if database search is not explicitly used by users.

**Name of the Vulnerable Software and Affected Versions** XXL-RPC (affected versions not specified) **Description** The issue concerns a high-performance, distributed RPC framework. When a TCP server is set up using the Netty framework and the Hessian serialization mechanism, attackers may be able to connect to the server and provide malicious serialized objects. Once deserialized, these objects can force the server to execute arbitrary code, potentially allowing attackers to take control of the machine the server is running on through remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Rejetto HTTP File Server versions 2.3m and earlier **Description** The vulnerability is related to the improper neutralization of special elements used in a template engine, allowing a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. This issue has been exploited in real-world attacks, with threat actors targeting older versions of the HTTP File Server to drop malware and cryptocurrency mining software. The estimated number of potentially affected devices worldwide is not explicitly stated, but it is known that over 89,700 services are found to be vulnerable. **Recommendations** For Rejetto HTTP File Server versions 2.3m and earlier, update to version 0.52.x, which is the recommended safe version of the product, as it is the latest release from the developer and includes support for HTTPS, dynamic DNS, and authentication for the administrative panel. Note: The provided information does not include any vulnerability identifiers (e.g., CVE numbers) in the response as per the guidelines.

**Name of the Vulnerable Software and Affected Versions** Gogs versions prior to 0.13.1 **Description** The built-in SSH server allows argument injection in `internal/ssh/ssh.go`, which can lead to remote code execution. Authenticated attackers with at least one SSH key can exploit this by opening an SSH connection and sending a malicious `--split-string` request via the `env` command if the built-in SSH server is enabled (configured as `[server] START SSH SERVER = true`). This allows the attacker to execute arbitrary commands with the privileges of the user specified by `RUN USER` in the configuration, potentially enabling access to or alteration of any user's code on the instance. Windows installations are not affected. Approximately 7,300 to 8,300 exposed instances have been identified. **Recommendations** Upgrade to version 0.13.1 or the latest 0.14.0+dev. As a temporary workaround, disable the use of the built-in SSH server on non-Windows operating systems.