Mateusz Gierblinski

Improper neutralization of special elements used in an SQL command, known as SQL injection, allows an authorized attacker to elevate privileges over a network. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, manipulating the database.

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

An insecure symlink following issue exists within the `pro collect-logs` command framework. The utility uses predictable temporary file paths or user-accessible log directories to gather diagnostic information without verifying file type or ownership. A local attacker can create a symbolic link (symlink)—a file that points to another file or directory—at a predictable path targeting root-readable files, such as `/etc/shadow`. When an administrator runs the `pro collect-logs` command, the tool follows the symlink and includes the contents of the target file in a diagnostic archive. Since the archive is readable by the unprivileged user, this leads to the disclosure of sensitive system secrets.

The software is subject to Stored Cross-Site Scripting, a condition where malicious scripts are permanently stored on the target server. The issue exists in the 'Project Details' custom field within Portfolio Items due to insufficient input sanitization and output escaping of user-supplied attributes in the `project details` variable. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute when a user accesses the affected page.

The software is susceptible to Stored Cross-Site Scripting through the 'Call to Action' custom fields. Insufficient input sanitization and output escaping on user-supplied attributes in the 'action text', 'action button text', 'action link', and 'action class' custom fields allow authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Name of the Vulnerable Software and Affected Versions: Wibu CodeMeter versions prior to 8.30a Description: The issue allows for privilege escalation immediately after installation, before a logoff or reboot, under specific conditions. These conditions include an unprivileged installation with UAC and the presence of the CodeMeter Control Center component without it having been restarted. In this scenario, a local user can exploit the issue by navigating from Import License to a privileged instance of Windows Explorer, thus gaining elevated privileges. Recommendations: For versions prior to 8.30a, update to version 8.30a or later to resolve the issue. As a temporary workaround, consider restarting the CodeMeter Control Center component after installation to minimize the risk of exploitation.

The issue concerns the Iframe dashlet in EspoCRM, which allows users to display iframes with arbitrary URLs. Since the sandbox attribute is not included in the iframe, a remote page can open popups outside of the iframe, potentially tricking users and creating a phishing risk. The iframe URL is user-defined, so an attacker would need to trick the user into specifying a malicious URL. The missing sandbox attribute also allows the remote page to send messages to the parent frame, although EspoCRM does not utilize these messages.