Kta1Kri

Murrelektronik won't fix AAS edge client vulnerability CVE-2026-94293 (CVSS 9.8), which allows unauthenticated data changes. Remove it now. #Murrelektronik #AAS #CVE202694293 #ICS #OTSecurity #Industry40 #MissingAuthentication #Vulnerability https://t.co/L4xnuHY1I3

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.4 **Description** Authentication guards `CheckAuth()` in `kernel/model/session.go` and `IsSessionOriginAllowed()` in `kernel/util/net.go` fail open when the HTTP Origin header is absent. This occurs because the system incorrectly assumes all browser-initiated cross-site requests include an Origin header. Since browsers omit this header during cross-site top-level GET navigations and no-cors GET subresource loads, and the session cookie uses SameSite=Lax, a cross-site GET request from an attacker-controlled page can be granted RoleAdministrator privileges. This affects both default installations and password-protected instances with active sessions. When combined with content-type sniffing on the '/api/network/proxy' endpoint, an unauthenticated remote attacker can serve malicious HTML under the SiYuan origin, execute arbitrary scripts, invoke administrator APIs, and exfiltrate the persistent kernel API token. **Recommendations** Update to version 3.8.4.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.62 **Description** GitPython fails to validate the `path` field read from an untrusted .gitmodules file during submodule updates. While constraints exist for the `name` field and certain operations like add and move, the `update()` function derives the absolute checkout location from the raw `path` value without proper guards. An attacker can use directory traversal components in the `path` field to cause the creation of directories outside the repository working tree via `os.makedirs()`, populate them from the submodule URL, or remove them using `shutil.rmtree()` when `force remove` is enabled. This issue is exploitable in application flows that update submodules at a non-HEAD commit, such as a historical-commit API. **Recommendations** Update GitPython to version 3.1.62.