Nmmorette

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** NASA earthdata-search version 1.0.0 **Description** A server-side request forgery (SSRF) exists in the scale Endpoint component. This issue occurs within the `scaleImage()` function located in the `serverless/src/scaleImage/handler.js` file. A remote attacker can initiate a manipulation to trigger the flaw. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `scaleImage()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Grit42 Grit versions prior to 0.11.0 **Description** A SQL injection issue exists in the `GritEntityController` component, specifically within the file `modules/core/backend/app/controllers/concerns/grit/core/grit entity controller.rb`. This flaw allows a remote attacker to perform manipulations that result in the execution of arbitrary SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jsbroks COCO Annotator versions prior to 0.11.2 **Description** A path traversal issue exists in the Data Endpoint component within the file `backend/webserver/api/datasets.py`. A remote attacker can manipulate the `folder` argument to access files and directories outside the intended folder. Path traversal is a technique that allows an attacker to read or write files on the server by using special characters like "../" to navigate the file system. **Recommendations** Update jsbroks COCO Annotator to a version newer than 0.11.1. As a temporary workaround, restrict access to the Data Endpoint or avoid using the `folder` argument in the affected API endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** jsbroks COCO Annotator versions prior to 0.11.2 **Description** An authorization bypass exists in the Dataset API within the file `backend/webserver/api/datasets.py`. A remote attacker can initiate this attack by manipulating the `DatasetId` argument. **Recommendations** Update to a version later than 0.11.1. As a temporary workaround, restrict access to the `DatasetId` argument in the Dataset API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** jsbroks COCO Annotator versions up to 0.11.1 **Description** A flaw exists in jsbroks COCO Annotator that can lead to a denial of service. This issue affects the Endpoint component and involves the `/api/info/long task` file and an unknown function. The issue is remotely exploitable and has been publicly disclosed. The vendor was notified but did not respond. **Recommendations** Versions prior to 0.11.1 should be used.

**Name of the Vulnerable Software and Affected Versions** jsbroks COCO Annotator versions up to 0.11.1 **Description** A flaw exists in jsbroks COCO Annotator that allows for improper authorization. This issue is related to the manipulation of the `ID` argument within an unknown function of the `/api/undo/` file in the Delete Category Handler component. The attack can be initiated remotely, and an exploit is publicly available. The vendor was notified but did not respond. **Recommendations** Versions prior to 0.11.1 should be used.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar versions up to 2.10 **Description** A security issue exists in Portabilis i-Educar. This issue involves the manipulation of the `File` argument within the `/intranet/meusdadod.php` file, specifically related to the User Data Page component, leading to cross site scripting. The attack can be launched remotely. The exploit is publicly available. The vendor was contacted but did not respond. **Recommendations** Versions prior to 2.10 should be updated.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** A Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application. The vulnerability resides in the “Tags” input field on the `/s/ajax?action=lead:addLeadTags` endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session. A Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, and manipulate the web page content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Scada-LTS versions prior to 2.7.8.2 Description: A vulnerability was identified in Scada-LTS up to version 2.7.8.1. The affected element is an unknown function within the `/pointHierarchySLTS` file of the Folder Handler component. Manipulation of the `Title` argument leads to cross-site scripting. The attack can be initiated remotely, and the exploit is publicly available. Recommendations: Scada-LTS versions prior to 2.7.8.2: Update to version 2.7.8.2 or later to resolve this issue. As a temporary workaround, consider restricting access to the `/pointHierarchySLTS` file or disabling the vulnerable function until a patch is available.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario version 1.6 Description: A vulnerability exists in Portabilis i-Diario 1.6 within the Dicionário de Termos BNCC Page component. Manipulation of the `Planos de ensino` argument in the `/dicionario-de-termos-bncc` file leads to cross site scripting. The attack can be launched remotely and the exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond. Recommendations: Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/dicionario-de-termos-bncc` file. Sanitize the `Planos de ensino` argument to prevent script injection.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions prior to 1.7 Description: A cross-site scripting issue exists in Portabilis i-Diario due to manipulation of the `código/objetivo habilidade` argument within an unknown function of the `/objetivos-de-aprendizagem-e-habilidades` file of the History Page component. This allows for remote attacks. The exploit has been publicly disclosed. Recommendations: Update Portabilis i-Diario to version 1.7 or later. As a temporary workaround, restrict or sanitize input to the `código/objetivo habilidade` argument in the `/objetivos-de-aprendizagem-e-habilidades` file.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.9.0 Description: A critical issue exists in Portabilis i-Educar related to improper authorization. The vulnerability is located in the API Endpoint component, specifically within the `/module/Api/pessoa` file. Manipulation of the `ID` argument can lead to unauthorized access. The exploit is publicly available and can be initiated remotely. The vendor was informed of this issue but did not provide a response. Recommendations: Versions prior to 2.9.0: Address improper authorization by validating the `ID` argument in the `/module/Api/pessoa` API Endpoint.

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar versions up to 2.9.0 Description: A vulnerability exists in Portabilis i-Educar that allows for authorization bypass. The issue affects an unknown part of the file `/module/Api/Diario` within the API Endpoint component and can be exploited remotely. The exploit has been publicly disclosed and may be used. The vendor was contacted regarding this disclosure but did not respond. Recommendations: Versions prior to 2.9.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar version 2.10 **Description** A problematic vulnerability exists in Portabilis i-Educar 2.10. The `Gerar` function within the file `ieducar/intranet/educar matricula lst.php` is affected. Manipulation of the `ref cod aluno` argument can lead to cross-site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. **Recommendations** Apply the patch with identifier 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar version 2.10 **Description** A flaw exists in Portabilis i-Educar 2.10 within the `atendidos cad.php` file. Manipulation of the `nome`/`nome social`/`email` argument can trigger cross-site scripting. This issue is remotely exploitable. The exploit has been publicly disclosed and may be actively used. The vendor was notified but did not respond. **Recommendations** As a mitigation, sanitize or encode the `nome`, `nome social`, and `email` parameters before using them in the `atendidos cad.php` file.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Educar version 2.10 **Description** A cross-site scripting issue exists due to the improper handling of user-supplied input. Specifically, manipulating the `ref cod matricula` argument with the input "> can trigger the vulnerability. The issue resides within the `/educar aluno lst.php` file. The exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond. **Recommendations** Update to a newer version of Portabilis i-Educar that addresses this issue. As a temporary workaround, sanitize the `ref cod matricula` input to prevent the injection of malicious code.

Name of the Vulnerable Software and Affected Versions: Scada-LTS version 2.7.8.1 Description: A vulnerability exists in Scada-LTS 2.7.8.1 within an unknown functionality of the file `/Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr`. Manipulation of this functionality can lead to information disclosure. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The vendor states that the risks associated with this vulnerability appear minimal, as exploitation likely requires administrator permissions, and fixing the vulnerability will not reduce the overall risk from malicious administrator actions. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Diario version 1.5.0 **Description** A vulnerability exists in Portabilis i-Diario that allows for cross site scripting. The issue affects unknown code within the `/conteudos` file. The `filter[by description]` argument can be manipulated to trigger the vulnerability, and the attack can be initiated remotely. The exploit has been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Portabilis i-Diario version 1.5.0 **Description** A problematic issue exists in the justificativas-de-falta component of Portabilis i-Diario. The manipulation of the `Anexo` argument in the justificativas-de-falta Endpoint leads to cross site scripting. This issue can be exploited remotely. The details of the issue have been publicly disclosed, and the vendor was informed but did not respond. **Recommendations** As a mitigation, sanitize or validate the `Anexo` argument within the justificativas-de-falta Endpoint.