Peter Stöckli

Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference (IDOR) issue in the `GroupEventJsonView` endpoint. An Insecure Direct Object Reference occurs when an application uses user-supplied input to directly access objects, potentially allowing unauthorized access to data.

A flaw exists in WooCommerce that could allow authenticated customers to view order information belonging to guest customers, specifically on sites with a particular setup.

The login functionality of Umbrel contains a reflected cross-site scripting (XSS) vulnerability in `use-auth.tsx`. An attacker can specify a malicious `redirect` query parameter to trigger the vulnerability. If a JavaScript URL is passed to the `redirect` parameter, the attacker-provided JavaScript will be executed after the user enters their password and clicks on login.

A path traversal vulnerability accessible via MediaController's download private file method allows authenticated users to download any file on the web server Camaleon CMS is running on, depending on the file permissions. This issue may lead to Information Disclosure. The vulnerable `download private file` method is used to download private files, and the `file` parameter is passed to the `fetch file` method of the CamaleonCmsLocalUploader class. The issue can be exploited by visiting a URL such as `https://<camaleon-host>/admin/media/download private file?file=../../../../../../etc/passwd` to download the /etc/passwd file.

An issue allows an authenticated agent to perform a remote Denial of Service attack by calling an endpoint that accepts a generic method name, which was not properly sanitized against an allowlist.

The issue allows a connection to a malicious JMX/RMI server by default, potentially leading to the execution of arbitrary code via the RMI registry by a remote attacker.

The issue is related to the use of an old version of SnakeYAML in nGrinder, which could allow a remote attacker to execute arbitrary code via unsafe deserialization.

The issue allows remote attackers to execute arbitrary code via unsafe Java objects deserialization. This is possible because the software accepts serialized Java objects from unauthenticated users.

The issue allows an attacker to set a delay without limitation, potentially causing a Denial of Service. This could be exploited by a remote attacker.

The issue is related to a lack of access control, allowing an attacker to create or update webhook configuration. This could lead to information disclosure and limited Server-Side Request Forgery.

The issue is caused by a lack of access control, allowing an attacker to obtain the results of webhook requests. This could lead to information disclosure and limited Server-Side Request Forgery.

The go-saml library contains an authentication bypass issue due to the internal use of the `xmlsec1` command line tool to verify SAML assertions without restricting the origin of the public key for signature verification. This allows an attacker to sign SAML assertions with a self-provided public key, such as an RSA key, embedded in the SAML token.

The issue is related to a SAML token signature bypass vulnerability in VMware Tools. A malicious actor with man-in-the-middle (MITM) network positioning between vCenter server and the virtual machine may be able to bypass SAML token signature verification, to perform VMware Tools Guest Operations. This could allow an attacker to elevate their privileges if the target virtual machine has been assigned a more privileged Guest Alias.

A remote code execution issue was discovered in Autolab's MOSS functionality, allowing an instructor with access to the feature to potentially execute code on the server hosting Autolab.

A file disclosure issue was found in Autolab's remote handin feature, allowing users to submit assignments using paths outside their submission directory and view the file's contents.

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This vulnerability is specific to the Ruby on Rails Workbench application (“Workbench 1”). We do not believe any other Arvados components, including the TypesScript browser-based Workbench application (“Workbench 2”) or API Server, are vulnerable to this attack.

A denial of service issue exists due to insufficient input validation. This could allow a remote attacker to cause a denial of service. The issue is related to .NET (Core) server applications providing WebSocket endpoints, which could be tricked into endlessly looping while trying to read a single WebSocket frame.

The issue allows for Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This potentially affects all current users of Paginator prior to version 1.0.0.

The issue is related to an improper validation of certificates with host mismatch, where the WebSocketClient does not perform SSL hostname validation. This means that SSL certificates of other hosts are accepted as long as they are trusted. To exploit this, an attacker has to perform a man-in-the-middle (MITM) attack between a Java application using the Java-WebSocket Client and a WebSocket server it's connecting to. Normally, TLS protects users and systems against MITM attacks, but it cannot if certificates from other trusted hosts are accepted by the client.

A remote code execution issue exists due to improper input validation. This could allow a remote attacker to execute arbitrary code using specially crafted input data. Successful exploitation could enable an attacker to take control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system might be less impacted than those operating with administrative user rights.