Maksymilian Kubiak

The issue allows users to upload files of any type and extension without restriction in the Profile section of the Ready application. If the server is misconfigured, it can result in Remote Code Execution. This misconfiguration was present by default in installations from late 2021 and early 2022.

A cross-site scripting (XSS) issue in the upload functionality of Ready File Explorer allows the injection of arbitrary JavaScript code in the filename. The injected content is stored on the server and is executed every time a user interacts with the uploaded file.

The issue allows a low-privileged user to provide a link to a local file using the `file://` protocol, enabling the attacker to read the content of the file. This can be used to read the content of system files.

The issue arises from the improper neutralization of user input in a file search function within the invoices module, allowing for SQL Injection attacks. This can be exploited by a low-privileged user.

The issue allows IP address spoofing by providing a custom value in the `X-Forwarded-For` header, which compromises the action logging mechanism's accountability.

The issue allows an attacker with access to the Administration panel, specifically the "Role Management" tab, to inject code by adding a new role in the `name` field. However, the risk of exploiting this issue is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection.

The issue allows for HTML code injection into the page content through the `content` field in the Application definition page. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint, it is possible to perform a brute force attack on the current password in use.

The issue concerns code injection in the "modalDlgMsgInternal" parameter via POST in the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, which is then executed in the browser. The risk of exploitation is somewhat mitigated by the need to bypass the Content-Security-Policy.

Name of the Vulnerable Software and Affected Versions: GraphQL (affected versions not specified) Description: A vulnerability was found in GraphQL due to improper access controls on the `graphql introspection query`. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `graphql introspection query` to minimize the risk of exploitation. Apply available patches immediately to mitigate risks.

Name of the Vulnerable Software and Affected Versions: OpenShift (affected versions not specified) Description: A denial of service (DoS) issue was found in OpenShift, related to the GraphQL batching functionality. This allows attackers to send multiple queries within a single request, potentially submitting a request with thousands of aliases in one query. The issue leads to excessive resource consumption, causing application unavailability for legitimate users. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example, in a multisite setup.

The issue allows an attacker to manipulate client IP addresses retrieved from potentially untrusted headers, which can be used to bypass IP-based blocking.

The issue is related to a lack of input sanitization, allowing logged-in users to manipulate generated web pages via injection of HTML code. This could lead to a successful phishing attack, for example, by tricking users into using a hyperlink pointing to a website controlled by an attacker.

The issue arises when BMC Control-M loads all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users upon user login. This can be leveraged to load potentially malicious libraries, which will execute with the application's privileges.

The issue is related to improper authorization in the report management and creation module, allowing logged-in users to read and make unauthorized changes to any reports within the application, even without proper permissions. The attacker must know the unique identifier of the report they want to manipulate.

The issue allows attackers to run arbitrary SQL commands via the `Find` parameter in the Select Classifier dialog box. This can be exploited by attackers to execute unauthorized SQL queries.

The issue allows a local attacker to obtain the password to other systems by decoding the key for an encrypted password. This can be achieved if the attacker gains access to the encrypted password.

The issue is related to insufficient authorization procedure in the IBM i Access Client Solutions, allowing a remote attacker to execute arbitrary code due to improper authority checks. This could enable the attacker to perform operations on the PC under the user's authority.

The issue allows an attacker to obtain a decryption key due to improper authority checks.