Jean-Marie Bourbon

Hardcoded credentials allow unauthenticated attackers to recover static OAuth `clientId` and `clientSecret` values embedded in JavaScript delivered to the frontend, such as in the `parameters.js` file. Attackers can use these exposed credentials to reproduce the application portion of the REDY authentication flow at the '/web/api/v1/auth/token' endpoint, which undermines the confidential-client assurance of the OAuth implementation.

A pre-authentication reflected cross-site scripting issue exists where unauthenticated attackers can inject and execute arbitrary JavaScript. This is achieved by submitting a crafted `LINK` query parameter to the '/System/Session-1' endpoint. Exploitation can lead to credential harvesting, manipulation of the login flow, access to browser-visible data, and the execution of same-origin requests to controller endpoints, including an origin-switch primitive against the internal controller in Cloud RIA scenarios.

WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts at paths such as /easy/GUI/Skins/Default/SiteLogo and /easy/GUI/Skins/Default/Identity. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate the enrollment flow against REDY instances, crossing IT/OT segmentation boundaries through a sanctioned application path.

Authenticated attackers can exploit a race condition—a situation where the system's behavior depends on the sequence or timing of uncontrollable events—to interrupt active diagnostic processes. By triggering a diagnostic operation, such as ping or traceroute, and simultaneously invoking the file deletion endpoint, an attacker can delete output files written to predictable paths within the diagnostic directory. This action terminates the running process and can leave the system in an inconsistent state.

The software embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection within the application, these primitives allow attackers to escape the AngularJS sandbox and execute arbitrary JavaScript in operator browser sessions. This can lead to session hijacking, DOM manipulation, and persistent browser compromise. In plaintext HTTP deployments, network-adjacent attackers can deliver the injection and escape chain via a Man-in-the-Middle (MITM) attack without active user interaction.

Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. This absence allows the unrestricted loading of external JavaScript resources from attacker-controlled origins. When combined with template injection and sandbox escape issues within the application, this lack of CSP removes browser-enforced restrictions, enabling the loading of arbitrary remote payloads into operator browser sessions.

The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change `User-Agent` headers to reset rate limits, request nonces from the unauthenticated `/wpdGetNonce` API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation.

The software contains a shortcode injection issue that allows attackers to execute arbitrary shortcodes. This is achieved by including shortcodes in comment content sent via email notifications. Attackers can inject shortcodes such as `[contact-form-7]` or `[user meta]` within comments. These shortcodes are executed server-side when the `WpdiscuzHelperEmail` class processes notifications through the `do shortcode()` function before `wp mail()`. The `do shortcode()` function is used to process shortcodes within the comment content.

The software contains a stored cross-site scripting issue that permits authenticated attackers to inject malicious JavaScript. This is achieved by importing a specially crafted options file containing unescaped custom CSS field values. Attackers can provide a malicious JSON import file with script payloads within the `customCss` parameter. These payloads execute on every page when rendered through the options handler due to insufficient sanitization.

The issue allows for a Server-Side Request Forgery (SSRF) attack. A registered user can exploit the `edit blog.php` script by adding a malicious URL or TCP port to target internal networks or internet-hosted servers, bypassing firewall rules and IP filtering. This is a "blind" vulnerability, as there is no response available on the Moodle website, requiring attackers to use a "time-based" approach to exploit it.

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 6.13.1 Description: The issue allows an authenticated user to download a deleted page via the word export feature. Recommendations: For versions prior to 6.13.1, update to version 6.13.1 or later to resolve the issue.

The issue allows local users to conduct a jailbreak attack and obtain root privileges by overwriting the /etc/shadow file, due to /usr/bin/lua being installed setuid to the itadmin account. This enables a BusyBox jailbreak attack.