Michael Scherer

Name of the Vulnerable Software and Affected Versions: Ipsilon versions 0.1.0 through 1.0.0 Description: The default configuration of the Jinja templating engine in the Identity Provider (IdP) server does not enable auto-escaping, making it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. Recommendations: For Ipsilon versions 0.1.0 through 1.0.0, consider enabling auto-escaping in the Jinja templating engine configuration to mitigate the risk of cross-site scripting (XSS) attacks.

Name of the Vulnerable Software and Affected Versions: Ipsilon versions 0.1.0 through 1.0.0 Description: The issue arises from the Identity Provider (IdP) server not properly escaping certain characters in a Python exception-message template. This makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via an HTTP response. Recommendations: For Ipsilon versions 0.1.0 through 1.0.0, update to version 1.0.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Zimbra 2013 Description: The issue is related to a Cross-Site Scripting (XSS) problem. It affects the aspell.php file. Recommendations: For Zimbra 2013, consider disabling access to the aspell.php file as a temporary workaround until a patch is available.

The issue concerns a predictable /tmp in the set-proxy connection hook of the OpenShift haproxy cartridge, which could facilitate a denial-of-service (DoS) attack.

The issue is related to the improper creation of files in /tmp by the dump.sh script in the cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin directory of OpenShift.

The issue is related to insufficient input validation in Ansible, allowing an attacker to execute arbitrary code. Specifically, when running ad-hoc commands, inventory variables are loaded from the current working directory, which can be under an attacker's control. This can lead to the execution of arbitrary code.

The issue allows local users to have unspecified impact via a symlink attack on an unspecified file in /tmp. This is related to the oo-analytics-export and oo-analytics-import components in the openshift-origin-broker-util package.

The issue allows for file download over an insecure channel when performing a mirror update, potentially resulting in remote code execution.

The issue allows local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file. This is due to unspecified tests in the software.

The issue allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory. This is related to the hs.py component in OnionShare.

The issue allows local users to write to configuration files via a symlink attack on a temporary file. This is due to vulnerabilities in several functions, including ` write config`, `reset configuration`, `write config`, ` write mycnf`, `InnoBackupEx:: run prepare`, `InnoBackupEx::cmd`, `MySQLDump::cmd`, `InnoBackupExIncremental::cmd`, ` get actual db status`, and multiple class CbBackup methods.

The issue exists due to the failure to neutralize special elements in the get sdl function of the PHP interpreter. Exploitation of this issue may allow an attacker to disclose protected information, impact data integrity, or cause a denial of service. The default configuration of the soap.wsdl cache dir setting in PHP's configuration files specifies the /tmp directory, which facilitates local users' ability to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the `get sdl` function.

The issue arises from improper handling of files in /tmp by the `modules/chef.py` module in SaltStack.

The issue is related to the `modules/serverdensity device.py` module in SaltStack, which does not properly handle files in the `/tmp` directory. This can be exploited to gain unauthorized access to confidential data, cause a denial of service, or impact data integrity.

The issue allows remote attackers to execute arbitrary YAML code. The vendor has noted that this might not be considered a vulnerability because the YAML to be loaded has already been determined to be safe.

The issue allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/. This occurs when the playbook does not run due to an error.

The issue allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. This occurs when using ControlPersist in the `runner/connection plugins/ssh.py` module.

The issue allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by certain scripts, including tests/volume.rc and extras/hook-scripts/S30samba-stop.sh.

The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. This is due to the `diff pp` function in `lib/gauntlet rubyparser.rb`.