Marcin Ressel

GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to any Windows system on which the agent is installed and which provides communication via SMB or WebDav. This issue was fixed in version 2.8.33.

**Name of the Vulnerable Software and Affected Versions** EAP Legislator versions prior to 2.25a **Description** EAP Legislator is susceptible to a Path Traversal issue within its file extraction functionality. An attacker can craft a malicious zipx archive – the default file type used by the application – and specify an arbitrary path outside the intended directory. Upon opening the crafted file, the application will extract files to the attacker-defined location, potentially including sensitive system areas like the system startup directory. **Recommendations** Update to version 2.25a or later.

**Name of the Vulnerable Software and Affected Versions** Wirtualna Uczelnia versions prior to wu#2016.1.5513#0#20251014 113353 **Description** The application has an insecure 'redirectToUrl' mechanism that incorrectly processes the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, potentially allowing an unauthenticated attacker to execute arbitrary code. The vulnerable component is the processing of the `redirectUrlParameter` parameter within the 'redirectToUrl' mechanism. **Recommendations** Update Wirtualna Uczelnia to version wu#2016.1.5513#0#20251014 113353 or later.

**Name of the Vulnerable Software and Affected Versions** Opera versions 10.10 through 10.50 **Description** The issue is caused by an integer overflow that allows remote attackers to execute arbitrary code via a large Content-Length value, triggering a heap overflow. **Recommendations** For Opera versions 10.10 through 10.50, update to a version that fixes the integer overflow issue to prevent remote code execution.