Ky0Tofu

Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's configured URL before making an outbound HTTP request, allowing a user holding the Capability Administration permission to cause the server to send requests to internal network locations (Server-Side Request Forgery). This permission is granted by role assignment, independent of authentication status, so an unauthenticated user could also trigger this behavior if the anonymous role has been granted the permission.

**Name of the Vulnerable Software and Affected Versions** .NET (affected versions not specified) **Description** Improper authorization in the .NET software platform allows an authorized attacker to elevate privileges locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** .NET (affected versions not specified) **Description** A heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when an application writes more data to a heap-allocated memory block than it can hold, potentially leading to memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** .NET (affected versions not specified) **Description** Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

**Name of the Vulnerable Software and Affected Versions** Sonatype Nexus Repository versions 3.6.0 through 3.91.0 **Description** An authenticated user with upload permissions to a hosted repository can store content that triggers arbitrary JavaScript execution in the browser of any user viewing that repository directory through the HTML index page. This allows an attacker to perform actions within the context of the victim's session. **Recommendations** Update to version 3.92.0 or later.

**Name of the Vulnerable Software and Affected Versions** systemd versions 258 through 259 **Description** A local unprivileged user can trigger an assert when a unit with `Delegate=yes` and `User=<unset>` is running. **Recommendations** Update to version 260.

**Name of the Vulnerable Software and Affected Versions** Shopire theme for WordPress versions prior to 1.0.58 **Description** The Shopire theme for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the `shopire admin install plugin()` function. Attackers with Subscriber-level access or higher can install the 'fable-extra' plugin. **Recommendations** Update the Shopire theme to version 1.0.58 or later.