Oskar-Zeinomahmalat-Sonarsource

**Name of the Vulnerable Software and Affected Versions** file selector versions prior to 0.5.1+12 file selector android versions prior to 0.5.1+12 **Description** The file names constructed within file selector are missing sanitization checks, leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using their app and could potentially override internal files in their app cache. **Recommendations** For file selector versions prior to 0.5.1+12, update to the latest version of file selector android that contains the changes to address this vulnerability. For file selector android versions prior to 0.5.1+12, update to version 0.5.1+12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** image picker versions prior to 0.8.12+18 image picker android versions prior to 0.8.12+18 **Description** The file names constructed within image picker are missing sanitization checks, leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using the app and could potentially override internal files in the app cache. **Recommendations** For image picker versions prior to 0.8.12+18, update to the latest version of image picker android that contains the changes to address this issue. For image picker android versions prior to 0.8.12+18, update to version 0.8.12+18 or later to resolve the vulnerability.

Name of the Vulnerable Software and Affected Versions: SnappyMail versions prior to 2.38.0 Description: SnappyMail is an open source web-based email client that uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research discovered that the function has bugs which cause an mXSS exploit, allowing a motivated attacker to inject JavaScript. However, due to the default Content Security Policy, the impact of the exploit is minimal. It could be possible to create an attack that leaks some data when loading images through the proxy, or to load a JavaScript attachment of the email. Recommendations: For versions prior to 2.38.0, users are advised to upgrade to version 2.38.0 or later. For older versions, an extension named "Security mXSS" can be installed as a mitigation, available at the administration area at `/?admin#/packages`. As a temporary workaround, consider disabling the `cleanHtml()` function until a patch is available. Restrict access to the vulnerable `cleanHtml()` function to minimize the risk of exploitation. Avoid using the `cleanHtml()` function in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playbook to read arbitrary files in the celery container, leading to sensitive information disclosure. The Celery container runs as root and has database access, allowing the attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. Recommendations: For JumpServer versions prior to 3.10.12, upgrade to version 3.10.12 or later. For JumpServer versions prior to 4.0.0, upgrade to version 4.0.0 or later. As a temporary workaround, consider restricting access to the Celery container to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: The issue is related to the JumpServer Privileged Access Management (PAM) tool, which provides secure access to various endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to remote code execution (RCE) in the Celery container. The Celery container runs as root and has database access, allowing an attacker to steal all secrets for hosts, create a new JumpServer account with admin privileges, or manipulate the database in other ways. Recommendations: For JumpServer versions prior to 3.10.12, upgrade to version 3.10.12 or later. For JumpServer versions prior to 4.0.0, upgrade to version 4.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** @hoppscotch/cli versions prior to 0.8.0 **Description** The @hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to version 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code, as code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox. **Recommendations** For versions prior to 0.8.0, update to version 0.8.0 or later to fix the issue. As a temporary workaround, consider restricting the use of the `@hoppscotch/js-sandbox` package until a patch is applied. Avoid passing references to external objects into the vm context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JumpServer versions prior to 3.10.7 **Description** JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. **Recommendations** For versions prior to 3.10.7, update to version 3.10.7 to fix the vulnerability. As a temporary workaround, consider restricting access to the Celery container or limiting its privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JumpServer versions prior to 3.10.7 **Description** The issue is related to insufficient input validation in JumpServer's Ansible, allowing remote attackers to bypass the input validation mechanism and execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. **Recommendations** For versions prior to 3.10.7, update to version 3.10.7 to resolve the issue. As a temporary workaround, consider restricting access to the Ansible module in JumpServer to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** jumpserver versions prior to 3.8.0 **Description** A flaw in the Core API of jumpserver allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. This enables attackers to make unlimited password attempts by altering their apparent IP address for each request. **Recommendations** For versions prior to 3.8.0, update to version 3.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the Core API to minimize the risk of exploitation. Avoid using the API for password attempts until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** JumpServer versions prior to 2.28.20 JumpServer versions prior to 3.7.1 **Description** The verification code for resetting a user's password in JumpServer is vulnerable to brute-force attacks due to the absence of rate limiting. This allows for up to 1,000,000 validation attempts within a 1-minute window. The issue is related to the 6-digit verification code sent to users to facilitate password reset. **Recommendations** For versions prior to 2.28.20, upgrade to version 2.28.20 or later. For versions prior to 3.7.1, upgrade to version 3.7.1 or later. As a temporary workaround, consider implementing rate limiting on the password reset feature until a patch is available. Restrict access to the password reset functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** JumpServer versions prior to 2.28.20 JumpServer versions prior to 3.7.1 **Description** The issue concerns the authentication procedure in JumpServer, an open source bastion host. An unauthenticated user can authenticate to the core API using a username and an SSH public key without needing a password or the corresponding SSH private key. This is possible because the API for the KoKo component to validate user private key logins does not verify the source of requests and will generate a personal authentication token. Given that public keys can be easily leaked, an attacker can exploit the leaked public key and username to authenticate, subsequently gaining access to the current user's information and authorized actions. **Recommendations** For versions prior to 2.28.20, upgrade to version 2.28.20 or later. For versions prior to 3.7.1, upgrade to version 3.7.1 or later. As a temporary workaround, consider restricting access to the KoKo component API until a patch is available. Avoid using the `username` and `SSH public key` for authentication until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** JumpServer versions prior to 2.28.20 JumpServer versions prior to 3.7.1 **Description** An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. **Recommendations** For JumpServer versions prior to 2.28.20, upgrade to version 2.28.20 or later. For JumpServer versions prior to 3.7.1, upgrade to version 3.7.1 or later. As a temporary workaround, consider restricting access to the WEB CLI interface provided by the koko component until a patch is applied. Avoid using the `execSync` function in the authorized mongoDB database to minimize the risk of exploitation.