Rahul Karne

Improper TLS certificate validation in the HashiCorp Vault KMS integration may allow a remote attacker to obtain sensitive information. TLS (Transport Layer Security) is a cryptographic protocol designed to provide communications security over a computer network.

An issue allows unauthenticated attackers with network access to perform server-side request forgery (SSRF), a technique where an attacker forces a server to make requests to an unintended location. By providing a malicious `uri` query parameter to the HTTP API, attackers can use `tcp://` or `unix://` URIs to override the configured backend and redirect connections to arbitrary targets. The affected endpoints include '/api/info', '/api/speech-to-text', and '/api/text-to-speech'.

Unauthenticated attackers can inject arbitrary SQL due to improper quote-escaping in the `DefaultParameterFormatter.format()` function. Specifically, DELETE and CTAS statements are routed to the ` escape hive()` function, which uses backslashes to escape single quotes instead of doubling them. Since Athena and Trino do not recognize backslashes as escape characters within string literals, a single quote in the input can prematurely terminate the string literal. This allows for data exfiltration via UNION SELECT, the execution of destructive statements, and unauthorized control over CTAS destination and content.

A code injection flaw exists where attackers controlling input schemas can achieve remote code execution. By providing a malicious `customBasePath` value containing embedded newlines and a dot-free Python expression, the value is inserted directly into a generated 'from ... import ...' statement without identifier validation. This results in the execution of arbitrary Python code when the generated module is imported.

A path traversal issue, specifically a Tar Slip, exists when the ` extract archive()` function in cornac/utils/download.py processes a crafted TAR archive. By using absolute paths, symlink/hardlink entries, or `../` sequences, an attacker can cause `archive.extractall()` to write arbitrary files outside the intended cache directory to any location on the filesystem accessible to the running process. This can be triggered via built-in dataset loaders that automatically download and extract archives.

An unsafe deserialization issue exists in the WebDataset reader. An attacker can achieve remote code execution by providing a malicious tar archive to the `read webdataset()` function. The ` default decoder()` function in webdataset datasource.py unconditionally calls `pickle.loads()` on tar entries with .pkl or .pickle extensions and `torch.load()` with `weights only=False` on .pt or .pth entries. This results in the execution of arbitrary code within Ray remote workers on every worker that processes the malicious archive. Deserialization is the process of converting a data format back into an object, which becomes unsafe when untrusted data is processed without validation.

An uncontrolled resource consumption issue exists in the `Wpcf7cfMailParser` class. The `hide hidden mail fields regex callback()` method processes an iteration count from user-supplied POST parameters without validation or upper bound enforcement. Unauthenticated attackers can send an arbitrarily large integer via a REST API endpoint to trigger an unbounded loop with multiple `preg replace()` operations, leading to server memory exhaustion and PHP process crashes.

The Aruba HiSpeed Cache WordPress plugin is susceptible to a cross-site request forgery (CSRF) issue impacting several administrative AJAX actions. Specifically, the `ahsc reset options`, `ahsc debug status`, and `ahsc enable purge` handlers authenticate and check user capabilities but fail to validate a WordPress nonce for requests that alter the system's state. An attacker could potentially trick a logged-in administrator into visiting a malicious webpage, causing the submission of forged requests to the `admin-ajax.php` endpoint. This could lead to unauthorized changes, such as resetting plugin settings, modifying the WordPress WP DEBUG configuration, or altering cache purging behavior. The vulnerable parameters are not explicitly mentioned.

The ElementsKit Lite WordPress plugin versions prior to 3.7.9 exposes the REST endpoint `/wp-json/elementskit/v1/widget/mailchimp/subscribe` without authentication. The endpoint accepts client-supplied Mailchimp API credentials and insufficiently validates the `list` parameter when constructing upstream Mailchimp API requests. An unauthenticated attacker can abuse the endpoint as an open proxy to Mailchimp, potentially triggering unauthorized API calls, manipulating subscription data, exhausting API quotas, or causing resource consumption on the affected WordPress site.