Rabbit

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.3 Description OpenSSH versions before 10.3 do not confirm connection multiplexing in proxy-mode multiplexing sessions. Recommendations Update to version 10.3 or later.

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.3 Description OpenSSH versions before 10.3 may allow command execution through shell metacharacters present in a username specified within a command line. This requires an untrusted username on the command line and a non-default configuration of '%' in the ssh config file. Recommendations Update to OpenSSH version 10.3 or later.

OpenSSH mishandles the `authorized keys` principals option in scenarios involving a principals list and a Certificate Authority (CA) that uses comma characters. A parsing error occurs where a comma in an SSH certificate principal name is incorrectly interpreted as a list separator rather than part of a string. This allows a user with a valid certificate from a trusted CA to bypass access controls and authenticate as root, effectively escalating low-privilege credentials to root access. The issue is caused by a code reuse error where the function handling the matching of cipher and key lists splits strings by commas and grants authentication if any fragment matches a subject value. Because the server perceives the authentication as legitimate, the attack does not trigger authentication failures in logs, making detection unreliable.

A critical issue has been found that affects the function `selectNoticeList` of the file `com/cloudweb/oa/mapper/xml/OaNoticeMapper.xml`. The manipulation of the argument `sort` leads to SQL injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

A critical vulnerability was found in ywoa, affecting the `listNameBySql` function of the file `com/cloudweb/oa/mapper/xml/UserMapper.xml`. This vulnerability leads to SQL injection and can be initiated remotely. The exploit has been disclosed to the public and may be used.

A problematic issue has been found in the function `extract` of the file `c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java` of the component `WXCallBack Interface`. The manipulation leads to an xml external entity reference. The attack may be initiated remotely.

Name of the Vulnerable Software and Affected Versions: ywoa versions up to 2024.07.03 Description: A critical issue affects the function `selectList` of the file `com/cloudweb/oa/mapper/xml/AddressDao.xml`, leading to SQL injection. The attack may be initiated remotely. Recommendations: Upgrading to version 2024.07.04 is able to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider disabling the `selectList` function until a patch is available.

A critical issue has been identified, affecting unknown code in the /oa/setup/setup.jsp file. This leads to improper authorization and can be exploited remotely. The issue has been publicly disclosed.

A cross-site scripting (XSS) issue in the "/apply/getEditPage?view" interface allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables the execution of malicious code on the victim's browser, potentially leading to unauthorized actions or data theft.

A cross-site scripting (XSS) issue in the `openSelectManyUserPage?orgid` interface of JFinalOA allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables the execution of malicious scripts, potentially leading to unauthorized actions on the affected system.

A cross-site scripting (XSS) issue in the "getBusinessUploadListPage?busid" interface allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This enables the execution of malicious code on the victim's browser, potentially leading to unauthorized actions or data theft.

The issue is related to a SQL injection vulnerability. It occurs via the `s name` parameter at the "table/list" endpoint. This allows for potential exploitation.

A fastjson deserialization issue was discovered in the component system/table/addField. This issue affects MSFM and can be exploited via the `system/table/addField` component.

A fastjson deserialization issue was found in the component system/table/add. This issue affects MSFM and can be exploited via the system/table/add component.

The issue is related to a permission bypass in the component /interceptors/AuthInterceptor.cava. This component is part of the JeeWMS system, and the bypass could potentially allow unauthorized access.

The issue is related to an arbitrary file upload vulnerability in the `parserXML()` method. This allows attackers to execute arbitrary code via uploading a crafted file. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

A critical SQL injection vulnerability was found in the function `datagridGraph` of the file `/graphReportController.do`. The manipulation of the argument `store code` leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A critical issue was found in the software, affecting the file /wmOmNoticeHController.do, which allows for path traversal using '../filedir'. This can be exploited remotely. The issue has been publicly disclosed and may be used for attacks.

The vulnerable software is Guangzhou Huayi Intelligent Technology Jeewms, specifically versions up to 20241229. The vulnerability is a critical SQL injection issue that affects the function saveOrUpdate of the file org/jeecgframework/web/cgform/controller/build/CgFormBuildController.java. This vulnerability can be exploited remotely, and a public exploit has been disclosed, making it possible for attackers to use it. To address this issue, it is recommended to upgrade to version 20250101. The vulnerability has been assigned the CVE identifier CVE-2025-0391. #GuangzhouHuayiIntelligentTechnology #Jeewms #SQLInjection #CVE20250391 #RemoteExploitation #PublicExploit #UpgradeRecommended #CyberSecurity #VulnerabilityDisclosure

A problematic issue exists in FastAdmin related to improper path restriction within the `/index/ajax/lang` component. This allows for path traversal, potentially enabling remote attackers to access sensitive information. The issue affects an unknown functionality within the `/index/ajax/lang` file, where manipulation of the `lang` parameter can lead to unauthorized data access. Reports indicate that approximately 14,000 instances may be affected yearly. Exploitation of this issue has been publicly disclosed and is being actively used to retrieve database details. The **API endpoint** `/index/ajax/lang` is involved, and the `lang` parameter is a **vulnerable parameter**.