Lujiefsi

Authenticated Web UI or API users with delegated access to specific settings can inject Carriage Return (CR) or Line Feed (LF) characters into single-line fields. This allows the insertion of attacker-controlled directives or policy lines into privileged service configuration files. In the Dnsmasq path, affected variables include `dhcp boot.filename`, `dhcp boot.servername`, `dhcp boot.address`, and `dhcp options.value`, which are rendered into the `/usr/local/etc/dnsmasq.conf` file via the `api/dnsmasq/*` endpoint. Other affected areas include OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configurations. Exploitation can lead to altered service behavior, creation of service-side files, bypassing of Role-Based Access Control (RBAC) boundaries, or denial of service. Specifically, line injection through Monit mail password and adjacent text fields into `/usr/local/etc/monitrc` can result in root command execution.

An authentication bypass exists in the captive portal roaming feature. Unauthenticated attackers on the same Layer-2 segment can hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. This is achieved by sending forged gratuitous ARP (Address Resolution Protocol) replies—messages used to update the ARP cache of other devices—to bind the attacker's IP address to a victim's MAC address, thereby gaining portal access with traffic attributed to the victim.

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

A stored cross-site scripting issue exists in the blocklist name field, specifically involving the `file url.name` variable. This allows users with lower privileges to inject active HTML. The injected payload executes within the administrator's browser under the LuCI origin when the administrator accesses the AdBlock Fast status page.

An issue exists where authenticated users can inject active HTML via the `resolver url` parameter. This leads to a stored cross-site scripting (XSS) condition—a vulnerability where malicious scripts are permanently stored on the target server—that executes JavaScript in the administrator's browser origin when the HTTPS DNS Proxy status page is viewed.

Stored cross-site scripting occurs when unauthenticated LAN clients inject JavaScript through UPnP IGD AddPortMapping SOAP requests. The issue arises because the `NewPortMappingDescription` field can contain malicious HTML, which is stored by miniupnpd and subsequently rendered by luci-app-upnp without output encoding. This allows the payload to execute when administrators access the UPnP or Status pages.

LuCI fails to properly encode DHCPv6 lease hostnames before rendering them in status tables. This allows attackers on the same network to inject HTML markup by sending a DHCPv6 Client FQDN containing script tags. These scripts execute in the administrator's browser when the DHCP lease pages are viewed.

A permission verification flaw in Navidrome allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. The vulnerability exists in the API endpoints that manage transcoding settings, such as `POST /api/transcoding`, `PUT /api/transcoding/:id`, `DELETE /api/transcoding/:id`, and `GET /api/transcoding`. The application fails to properly validate whether a user has administrative privileges when handling transcoding configuration requests, despite the JWT token clearly indicating the user is not an administrator (`"adm":false`).

A vulnerability has been found in the HTTP RPC API component of ThingsBoard, which can lead to resource consumption. The attack can be launched remotely, but the complexity of an attack is rather high and the exploitation appears to be difficult. The issue is classified as problematic and affects an unknown functionality of the component.

An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.

The issue allows a remote attacker to execute arbitrary code via the gateway.py component.

An issue in the software allows a remote attacker to execute arbitrary code via the `cert manager.py` component.

The issue is related to session fixation, where a session remains valid after a password change. This could potentially allow unauthorized access. Users are advised to upgrade to a version that fixes this issue.

The issue affects an open source ticket reservation system, allowing an attacker to access data from other organizers by using a specially crafted request to receive the e-mail log sent by other events.

Alf.io is a free and open source event attendance management system. The issue allows users to access the admin area even after being invalidated or deleted. There are no known workarounds for this issue. All users are advised to upgrade to version 2.0-M4-2402 to address this issue.

iTop is an IT service management platform. When creating or updating an object, extkey values aren't checked to be in the current user silo. By forging an HTTP request, a user can create objects pointing to out of silo objects, such as a UserRequest in an out of scope Organization.

Metersphere is an open-source testing framework. Files uploaded to Metersphere may define a `belongType` value with a relative path like `../../../../` which may cause Metersphere to attempt to overwrite an existing file in the defined location or to create a new file. Attackers would be limited to overwriting files that the Metersphere process has access to.

Metersphere is an open source continuous testing platform. In the affected versions, some key APIs lack permission checks, allowing ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators.

The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability allows an attacker to delete dashboards or messages of other users by manipulating the request, for example, by replacing the ID of the dashboard or message with the ID of another user's dashboard or message. The interface for marking read messages is also affected.

The issue is related to a missing permission check on the user profile in CloudExplorer Lite, an open source cloud management tool. This allows users to add themselves to any organization. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.