Kwstubbs

A heap-based buffer over-write occurs during an X11 import when processing a crafted window title. This issue leads to heap memory corruption, which can result in a denial of service. A heap-based buffer over-write is a condition where data is written beyond the boundaries of a memory block allocated on the heap.

The Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView. On Android, this is via 'window.externalApp', and on iOS, it is via 'webkit.messageHandlers.getExternalAuth', 'revokeExternalAuth', and 'externalBus'. Two flaws allow this bridge to be accessed by all frames, including cross-origin iframes. Additionally, unsanitized interpolation of the JavaScript callback identifier enables a cross-origin iframe rendered within the app to execute arbitrary JavaScript in the main-frame origin of the Home Assistant frontend, which can be used to exfiltrate the signed-in user's access token.

Lack of library-level authorization in the download, size-check, and chapter metadata endpoints allows a low-privileged user to access content from libraries they are not assigned to. By knowing or guessing the `chapterId`, `volumeId`, or `seriesId`, an attacker can download full file contents, query file sizes, and read metadata. The affected endpoints are '/api/Download/volume-size', '/api/Download/chapter-size', '/api/Download/series-size', '/api/Download/volume', '/api/Download/chapter', '/api/Download/series', and '/api/Chapter'.

The `ReaderController.GetImage` endpoint is decorated with `[AllowAnonymous]`, which permits unauthenticated access to page images from any chapter in any library. Although the endpoint accepts an `apiKey` parameter, it is not validated. Because entity IDs are sequential integers, an attacker can enumerate all content on the server.

Sonarr is a PVR for Usenet and BitTorrent users. An unauthenticated remote attacker can potentially read any file readable by the Sonarr process. This includes application configuration files (containing API keys and database credentials) and Windows system files. This issue only impacts Windows systems. Files returned from the API were not limited to the directory on disk they were intended to be served from.

The issue is related to an insecure CORS configuration in the Cognita backend server, which allows arbitrary websites to send cross-site requests to the application.

A path traversal issue exists at "/v1/internal/upload-to-local-directory" when the `Local` environment variable is set to true, such as when Cognita is set up using Docker. This allows an attacker to overwrite the `/app/backend/ init .py` file. Because the Docker environment sets up the backend uvicorn server with auto-reload enabled, the overwritten file will automatically be reloaded and executed, enabling remote code execution in the context of the Docker container.

The issue concerns the CORS middleware setup in Rembg, which is configured to reflect all origins. This allows any website to send cross-site requests to the Rembg server, enabling them to query any API. Furthermore, even if authentication is enabled, the `allow credentials` setting is set to True, which would permit any website to send authenticated cross-site requests.

The issue allows an attacker to query the "/api/remove" endpoint to view pictures hosted on the internal network of the Rembg server, potentially leading to Information Disclosure. This is achieved by exploiting the URL query parameter in the endpoint.

The MouseTooltipTranslator Chrome extension is susceptible to Server-Side Request Forgery (SSRF) attacks. This occurs because the `pdf.mjs` script utilizes the URL parameter from the current URL to download and display a file to the extension user. Since `pdf.mjs` is imported in `viewer.html` and `viewer.html` is accessible from all URLs, an attacker can manipulate the user's browser into making a request to any arbitrary URL. There have been discussions with the maintainer regarding this issue, and it was decided not to patch it as it would require disabling a major feature of the extension in exchange for mitigating a low-severity issue.

The binance-trading-bot is an automated Binance trading bot with a trailing buy/sell strategy. Authenticated users can achieve Remote Code Execution on the host system due to a command injection vulnerability in the "/restore" endpoint. The name of the uploaded file is passed to shell.exec without sanitization, resulting in Remote Code Execution. This may allow any authorized user to execute code in the context of the host machine.

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. An open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The express middleware allows any website to make a cross-site request to home-gallery, thus allowing them to read any endpoint on home-gallery. Home-gallery is mostly safe from cross-site requests due to most of its pages requiring JavaScript, and cross-site requests such as fetch() do not render javascript. If an attacker is able to get the path of the preview images which are randomized, an attacker will be able to view such a photo. If any static files or endpoints are introduced in the future that contain sensitive information, they will be accessible to an attacker website.

The default setup of Home-Gallery.org is vulnerable to DNS rebinding due to the lack of TLS and user authentication. An attacker can exploit this by changing the DNS records of their domain to the internal IP address of the Home-Gallery instance, allowing them to extract photos from the gallery. The attack involves the attacker website changing its DNS records to the internal IP address of the Home-Gallery instance, and then reading the response of the web server after the IP address has changed. The response will be from the Home-Gallery instance, not the attacker website, because the IP address has been changed.

Name of the Vulnerable Software and Affected Versions: PlexRipper versions prior to 0.24.0 Description: PlexRipper's open CORS policy allows attackers to gain sensitive information by getting the user to access the attacker's domain. This enables an attacking website to access the "/api/PlexAccount" endpoint and steal the user's Plex login. Recommendations: For versions prior to 0.24.0, update to version 0.24.0 to fix the vulnerability. As a temporary workaround, consider restricting access to the "/api/PlexAccount" endpoint until the update is applied.

The issue is related to an arbitrary file deletion vulnerability. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a Plenti user serves their website. This problem may lead to information loss.

The issue is a universal cross-site scripting problem that allows another extension to execute arbitrary code in the context of the user’s tab. No known patches exist for this issue.

The issue is related to an arbitrary file write vulnerability. The `/postLocal` endpoint is vulnerable, which may lead to Remote Code Execution when a Plenti user serves their website.

AList, a file list program supporting multiple storages, contains a reflected cross-site scripting issue in the helper.go file. The endpoint "/i/:link name" takes a user-provided value and reflects it back in the response, which returns an application/xml response. This allows for the inclusion of HTML tags via XHTML, leading to a cross-site scripting vulnerability.

The default setup of Homepage is vulnerable to DNS rebinding due to the lack of certificate and authentication. An attacker can exploit this by changing the DNS records of their domain to the internal IP address of the Homepage instance, allowing them to extract private information such as API keys and other sensitive data. The attack involves the attacker's website changing its DNS records to the internal IP address of the Homepage instance, and then fetching the attacker's domain, which responds with the Homepage instance's data.

A CORS misconfiguration exists in memos where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account.