Nightrang3R

**Name of the Vulnerable Software and Affected Versions** Gitea versions 1.17 through 1.27.0 **Description** A critical code injection flaw exists in the `services/repository/files/patch.go` file. An attacker with write access to a repository can exploit the `diffpatch` API endpoint to install a malicious executable Git hook, allowing the execution of arbitrary shell commands with the privileges of the Gitea operating-system user. If open user registration is enabled, unauthenticated external attackers can register an account, create a repository, and gain the necessary write permissions to trigger the exploit. Real-world incidents have been documented where this issue was exploited to deploy cryptocurrency-mining payloads. In one observed attack, the exploit chain from account creation to the deployment of a crypto-mining dropper took approximately 11 seconds. The malicious activity involved identifying CPU-intensive processes, terminating competing miners, and downloading architecture-specific binaries. **Recommendations** Update Gitea to version 1.27.1 or later. As a temporary workaround, disable or restrict access to the `diffpatch` API endpoint. Review and restrict open user registration and repository write permissions.

**Name of the Vulnerable Software and Affected Versions** OpenTSDB versions prior to 2.4.1 **Description** A remote code execution issue occurs due to command injection in the `yrange` parameter. The `yrange` value is written to a gnuplot file in the /tmp directory, which is then executed via the mygnuplot.sh shell script. The attempted prevention of command injections by blocking backticks in tsd/GraphHandler.java is insufficient. This allows a remote attacker to execute arbitrary code. **Recommendations** For OpenTSDB versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `yrange` parameter in the affected API endpoint until a patch is available. Avoid using the `yrange` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** letodms version 3.3.6 **Description** The issue allows for CSRF via the change password function. **Recommendations** For letodms version 3.3.6, update to a version that includes a fix for this issue, if available. As a temporary workaround, consider restricting access to the change password function to minimize the risk of exploitation.