Justin Steven

The RadAsyncUpload component contains a timing side-channel issue during the processing of upload metadata. This allows remote attackers to recover protected metadata values by analyzing measurable timing differences to determine cryptographic validity.

The unarchive module in BBOT is susceptible to exploitation through the use of malicious archive files. When these files are extracted, they can trigger arbitrary file writes, potentially leading to remote code execution. An attacker can control write operations by supplying crafted archive payloads. This allows for the execution of arbitrary commands or malicious payloads on the affected system.

The gitlab module in BBOT may allow an attacker to disclose a GitLab API key to a server under their control by using a maliciously formatted git URL. This could potentially lead to unauthorized access or actions within the GitLab environment.

The gitdumper module in BBOT is susceptible to exploitation, allowing attackers to execute arbitrary commands on the host system. This occurs through the processing of malicious Git repositories. The module, designed to extract data from Git repositories, does not properly sanitize the `.git` directory, leading to a path traversal condition and potential remote code execution.

The git clone module in BBOT may allow an attacker to disclose a GitHub API key to a server they control by using a maliciously formatted git URL. The issue involves the potential exposure of the `github api key` through the git clone process.

The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string processing, potentially enabling attackers to execute arbitrary JavaScript code within the application's context. The vulnerability allows for remote code execution via cookies and imports.

The issue is related to errors in the representation of information by the user interface, which can allow an attacker to conduct spoofing attacks. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue arises from improper validation of the session token parameters, allowing a session token to be valid indefinitely.

The issue allows an attacker to use the Git Connectivity test function on the VCS project to initiate an SMB request, potentially leading to an NTLM relay attack.

A security issue was identified in Octopus Server where a session cookie could be used as the CSRF token.

The issue arises from the use of the same encryption process for both session cookies and variables in affected versions of the software.

The issue allows bypassing rate limiting on login using null bytes.

The issue is related to arbitrary code execution. Fish, a command line shell, can run arbitrary commands under an attacker's control when using the default configuration and changing to a directory controlled by the attacker. This can happen on shared file systems or extracted archives. Git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. The problem is fixed in fish 3.4.0. Running git in these directories, including using the git tab completion, remains a potential trigger for this issue.

The issue is related to errors in the representation of information by the user interface, which can allow an attacker to conduct spoofing attacks. There is also a mention of a remote code execution (RCE) issue in the Jupyter Notebook component of Visual Studio Code. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to an authenticated SQL injection vulnerability in the Events REST API. This occurs because user-supplied data in the API request is not parameterized correctly. Exploiting this vulnerability could allow unauthorized access to database tables.

The issue allows a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine, due to the way Rapid7's Metasploit msfvenom framework handles APK files.