Nir Yehoshua

The management web interface contains hard-coded default credentials. Remote attackers can authenticate using the factory-default account via cleartext HTTP to gain full Administrator access. This allows unauthorized administrative control of the charging station and the ability to obtain the complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details.

An OS command injection flaw exists in the software. An attacker with login access to the Linux system where the product is installed can execute arbitrary operating system commands after performing specific preparations.

Image Scanner Driver for Linux contains a link following vulnerability. This issue allows an attacker with local access to the Linux system to overwrite arbitrary files by employing a specific method in advance. Link following occurs when a program follows a symbolic link to a file or directory that the user should not be able to access or modify.

An issue exists where the plugin fails to prevent a token issued to a guest during checkout from being reused to modify the order tickets. This allows unauthenticated users to replace a paid ticket with a free one, enabling them to complete the order without payment.

The backup restoration process fails to properly validate the destination paths of files extracted from a backup package. This creates a Zip Slip condition, which is a type of path-traversal vulnerability where a crafted archive can force files to be written outside the intended restoration directory. High-privilege users, such as administrators, can exploit this to write arbitrary files elsewhere on the server, potentially leading to server-side code execution if executable content is placed in a web-accessible location.

An issue exists where the software does not properly restrict the changes a guest checkout token can authorize on an order. This allows unauthenticated users to mark their own unpaid orders as completed, resulting in the issuance of a valid paid ticket without any payment being processed. The exploitation involves the `order token` variable.

Security flaws exist that could allow an attacker to perform escalation of privilege, which is the act of gaining higher-level permissions than those originally assigned to a user account.

Security flaws exist that could allow an attacker to perform escalation of privilege, which is the act of gaining higher-level permissions than those originally assigned to a user account.

Security flaws exist that could allow an attacker to perform escalation of privilege, which is the act of gaining higher-level permissions than those originally assigned to a user account.

The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge valid JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties. By crafting arbitrary tokens, attackers can authenticate to the MQTT broker without legitimate credentials and gain unauthorized access to the device mesh networking interface.

Authenticated attackers can execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The `sync command` binary forwards this input directly to a shell execution sink in `command.lua`, allowing those with access to the MQTT broker to compromise the system.

Insufficient sanitization and escaping of several parameters before they are reflected into HTML attributes on public pages allow for reflected Cross-Site Scripting (XSS). This issue can be triggered against any visitor, including logged-in administrators. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

An issue exists where the plugin fails to sanitize a value from an unauthenticated request used to construct a log file path. An attacker possessing a site-to-site transfer key can exploit this to create a log file in any writable directory of the site, including the web root, via the `send to site connect` endpoint. The attacker controls the file location, although the file name includes a fixed suffix and the content is limited to the plugin's own log header.

An arbitrary file upload issue exists in the `proSol handleFileUpload()` function. The flaw stems from missing validation of the `Content-Disposition` header filename, which allows an attacker to override the allow-listed multipart filename before the file is saved. Additionally, a post-save extension check fails to delete the file after it has been written to the system. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. The nonce required to access the upload handler is publicly exposed via `wp localize script` on any front-end page that renders the job portal shortcode, enabling unauthenticated visitors to bypass the security check.

An unsafe deserialization issue exists when the library processes a crafted `model.pt` checkpoint file. The function `QuantizedModelLoader.load quantized model pt()` calls `torch.load` with the `weights only` parameter set to `False`, which triggers Python's pickle machinery. This allows an attacker to embed malicious ` reduce ` methods within the checkpoint file to execute arbitrary Python code and system commands when the file is loaded from a directory selected by the caller.

Insufficient capability checks on two administrative AJAX actions allow any authenticated user, including those with subscriber privileges, to perform unauthorized actions. Because the nonce (a unique token used to prevent cross-site request forgery) is exposed on the public frontend, an attacker can trigger administrative data synchronization and clear activity records via the `proSol ajaxTablesync` and `proSol ajaxClearlog` calls.

An issue exists where the plugin fails to validate user-supplied URLs and does not verify the requester's capability or nonce before executing a server-side HTTP request. This allows any authenticated user, including those with subscriber-level privileges, to perform Server-Side Request Forgery (SSRF)—a technique where the server is coerced into making requests to internal hosts and services. The attacker can specify the HTTP method, headers, and body for these requests via the `proSol url validate()` function.

An issue exists where a cookie value is not sanitized before being used in SQL queries. This cookie is processed on every request without authentication or capability checks, allowing unauthenticated users to read arbitrary data from the database and delete records stored by the plugin. The vulnerable component is the `removesite` cookie.

Name of the Vulnerable Software and Affected Versions: Bosch IP Helper versions prior to 1.00.0008 Description: The issue allows an attacker to execute arbitrary code on a victim's system by loading a DLL through an uncontrolled search path element. This can happen if the victim is tricked into placing a malicious DLL in the same application directory as the portable IP Helper application. Recommendations: For versions prior to 1.00.0008, update to a version that contains a fix for this issue to prevent arbitrary code execution. As a temporary workaround, consider restricting access to the application directory to minimize the risk of exploitation.