Paul Gerste

PostgreSQL is susceptible to a buffer overrun due to missing validation of multibyte character length during text manipulation. This allows a database user to craft queries that can overwrite memory, potentially leading to arbitrary code execution with the privileges of the operating system user running the database. The issue is triggered when processing maliciously crafted queries, specifically in the PL/pgsql function compilation when handling CREATE FUNCTION statements. An attacker with CREATE privilege can define a PL/Python user-defined function containing arbitrary Python code that executes with the privileges of the PostgreSQL server process. Approximately 3 million instances are estimated to be exposed globally. The vulnerability affects the `substring()` function, which may raise an error when processing non-ASCII text values sourced from database columns.

The Eclipse Paho Go MQTT v3.1 library is susceptible to an issue where UTF-8 encoded strings exceeding 65535 bytes in length may be incorrectly encoded. This occurs because the data length is converted to an int16 without overflow checks, potentially leading to corrupt packets or data leakage—for example, a portion of an MQTT topic might be included in the message body of a PUBLISH packet. The issue arises from converting the data length from an int64 or int32 to an int16 without proper validation.

The issue is related to SQL Injection due to improper handling of negative numbers.

Grafana is susceptible to a cross-site scripting (XSS) vulnerability stemming from a combination of a client path traversal and an open redirect. This allows attackers to redirect users to a malicious website hosting a frontend plugin capable of executing arbitrary JavaScript. The vulnerability does not require editor permissions and is exploitable even with anonymous access enabled. If the Grafana Image Renderer plugin is installed, a full read SSRF can be achieved. The default Content-Security-Policy (CSP) in Grafana may offer some mitigation, but is not fully effective. Over 46,000 instances of Grafana were reported as unpatched and vulnerable. The vulnerability allows for potential account takeover and remote code execution.

The built-in XY Chart plugin is affected by a DOM XSS issue. A user with Editor permissions can modify a panel to execute arbitrary JavaScript.

The issue arises when using Alt-Svc, as ALPN fails to properly validate certificates in scenarios where the original server redirects to an insecure site.

The issue allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine. This is due to a Cross-Site Request Forgery (CSRF) flaw.

The issue is related to the injection of arbitrary configuration options to the "hg clone" call when installing a package from a Mercurial VCS URL using pip. This can modify how and which repository is installed. The vulnerability does not affect users who aren't installing from Mercurial.

The issue is related to insufficient input validation in the Connector/J component of MySQL Connectors, allowing an unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can result in the takeover of MySQL Connectors.

The issue is related to insufficient input validation in Visual Studio Code, allowing an attacker to execute arbitrary code using a specially crafted file.

The issue is related to errors in processing input data in the Visual Studio Code GitHub Pull Requests and Issues Extension. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

The issue is related to insufficient input validation in the GitKraken GitLens plugin for Visual Studio Code, allowing an attacker to execute arbitrary code via a crafted file. This can be exploited by an attacker to gain unauthorized access and execute malicious code.

The issue is related to argument injection during the tagging of a new release. This could allow a remote attacker to disclose protected information. Unprivileged user accounts with at least one SSH key can read arbitrary files on the system, potentially leaking configuration files with database credentials, such as `[database]` and `[security] SECRET KEY`, as well as exfiltrating TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the `/opt/onedev/sites/` directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts. This issue can be used by unauthenticated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate through them and leak all project data.

Poetry is a dependency manager for Python that uses various commands, such as `git clone`, when handling dependencies from a Git repository. The commands are constructed using user input, and although Poetry avoids Command Injection vulnerabilities by passing an array of arguments, there is a possibility that user input starting with a dash (`-`) can be treated as an optional argument, leading to Code Execution. This can occur because some commands have options that can be leveraged to run arbitrary executables. If a developer is exploited, the attacker could steal credentials or persist their access. The exploit can still work even when the victim tries to ensure safety by vetting config files.

The issue is related to an untrusted search path in Poetry, which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This occurs when the application is run on Windows OS.

The issue allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This can lead to full control over the server, allowing attackers to steal and manipulate data or attack further systems.

The issue is related to incorrect code generation management in the Visual Studio Code editor. Exploitation of this issue may allow an attacker to execute arbitrary code.

The issue affects Windows users running Composer to install untrusted dependencies, subjecting them to command injection. Other operating systems and Windows Subsystem for Linux (WSL) are not affected.

Name of the Vulnerable Software and Affected Versions: Ghost versions 4.0.0 through 4.3.2 Description: An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched, and there is no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Recommendations: For Ghost versions 4.0.0 through 4.3.2, upgrade to version 4.3.3 as soon as possible. As a temporary workaround, consider blocking access to the `/ghost/preview` endpoint to mitigate the issue. To block access in nginx, use the following configuration: ``` location ~ /ghost/preview { rewrite ^(/(.*/)?ghost/)(.*)$ $1 redirect; } ``` This redirects the endpoint to `/ghost/`, which mimics the behaviour after the patch is applied. Additionally, logging out of Ghost Admin, suspending any users who cannot log out, can also help mitigate the issue.