Orange Tsai

Improper input validation in the NTP Footer allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web origin policy is a security mechanism that prevents scripts on one page from accessing data on another page unless they share the same origin.

Improper input validation in the ReadingList component allows a remote attacker who has already compromised the renderer process to bypass the web origin policy. This is achieved by using a specially crafted HTML page. The web origin policy is a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin.

An incorrect reference resolution in the WebView component allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one origin can interact with resources from another origin, by using a crafted HTML page.

An issue exists where sensitive information is exposed to an unauthorized actor, which could allow a remote attacker to perform spoofing over a network.

Name of the Vulnerable Software and Affected Versions: Microsoft Excel versions (affected versions not specified) Microsoft 365 Apps for Enterprise versions (affected versions not specified) Microsoft Office versions (affected versions not specified) Microsoft Office Long Term Servicing Channel versions (affected versions not specified) Microsoft Office Online Server versions (affected versions not specified) Description: The issue is related to a lack of data sanitization at the management level in Microsoft Office packages, including Microsoft Excel. Exploitation of this issue may allow an attacker to execute arbitrary code using a specially crafted malicious file. Recommendations: For Microsoft Excel, consider disabling the execution of external files until a patch is available. For Microsoft 365 Apps for Enterprise, restrict access to potentially vulnerable components to minimize the risk of exploitation. For Microsoft Office, Microsoft Office Long Term Servicing Channel, and Microsoft Office Online Server, avoid using potentially vulnerable features or modules until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apache Subversion versions up to and including 1.14.3 Description: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed. This issue affects Windows platforms only and does not impact UNIX-like platforms. Recommendations: For Apache Subversion versions up to and including 1.14.3, upgrade to version 1.14.4, which fixes this issue.

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.4.60 Description: The issue is related to Server-Side Request Forgery (SSRF) in the Apache HTTP Server on Windows, which can potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content. Existing configurations that access UNC paths will have to configure the new directive "UNCList" to allow access during request processing. Recommendations: To resolve the issue, users are recommended to upgrade to version 2.4.60, which fixes this problem. Existing configurations that access UNC paths should configure the new directive "UNCList" to allow access during request processing.

This issue allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of WinRAR. User interaction is required to exploit this issue, where the target must perform a specific action on a malicious page. The flaw exists within the archive extraction functionality, where a crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of the current user.

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.59 and earlier Description: The issue is related to a potential Server-Side Request Forgery (SSRF) in the mod rewrite module of the Apache HTTP Server. This allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod proxy. The vulnerability is due to insufficient validation of incoming requests. Recommendations: For Apache HTTP Server versions 2.4.59 and earlier, upgrade to version 2.4.60, which fixes this issue.

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.59 and earlier Description: A null pointer dereference in the mod proxy module of Apache HTTP Server allows an attacker to crash the server via a malicious request. This issue can be exploited by a remote attacker to cause a denial of service. Recommendations: For Apache HTTP Server versions 2.4.59 and earlier, upgrade to version 2.4.60, which fixes this issue. As a temporary workaround, consider restricting access to the mod proxy module to minimize the risk of exploitation.

The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the OTP reset functionality. This vulnerability allows remote authenticated users to delete arbitrary files via unspecified vectors.

The issue is related to faulty input validation in the core of Apache, allowing malicious or exploitable backend/content generators to split HTTP responses. This can be exploited by a remote attacker to perform HTTP response splitting attacks. The vulnerability is associated with the failure to handle CRLF sequences in HTTP headers.

The issue is related to an OS command injection vulnerability in the CGI component of Synology Router Manager. This vulnerability allows a remote attacker to execute arbitrary code.

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a "/fileupload" endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This vulnerability can be exploited by uploading malicious JSP files to the server, allowing unauthorized remote code execution.

The Samba vfs fruit module uses extended file attributes to provide enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. The vulnerability is related to an out-of-bounds heap read and write via specially crafted extended file attributes. The affected module is used for enhanced compatibility with Apple SMB clients and Netatalk 3 AFP file servers.

The issue is related to insufficient access controls in Microsoft Exchange Server, which can be exploited by a remote attacker to elevate their privileges.

The issue is related to incorrect code generation management in Microsoft Exchange Server. It allows a remote attacker to execute arbitrary code.

A security feature bypass in Microsoft Exchange Server allows a remote attacker to bypass security mechanisms and execute arbitrary code with SYSTEM privileges. This issue involves an arbitrary file write capability that can lead to remote code execution.

Microsoft Exchange Server contains a flaw that allows remote attackers to execute arbitrary code. The issue is related to insufficient validation of incoming requests, enabling a Server-Side Request Forgery (SSRF) attack via specially crafted HTTPS requests. These requests utilize malicious `X-AnonResource-Backend` and distorted `X-BEResource` cookies to authenticate on the server. Real-world exploitation has been observed in campaigns targeting diplomatic organizations in Indonesia, government entities in Taiwan, and software developers across various countries including Lebanon, Syria, Colombia, North Macedonia, Nepal, and Serbia. In these incidents, the flaw was used to gain initial access and deploy the SharkLoader loader to install Cobalt Strike Beacon on compromised systems.

The issue is related to insufficient access control in MobileIron products, allowing a remote attacker to execute arbitrary code. This can be achieved via unspecified vectors, potentially leading to remote code execution.