Robin Peraglie

There is an argument injection issue in the xfce4-mime-helper from the xfce4-settings package. This issue allows for argument injection, which can potentially be exploited.

Name of the Vulnerable Software and Affected Versions: Open Container Initiative umoci versions prior to 0.4.7 Description: The issue allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used. This is due to improper input validation in umoci. The vulnerability can be exploited by creating a malicious layer with a symlink, which can trick umoci into modifying host files. This affects both "umoci unpack" and "umoci raw unpack" commands. Recommendations: For versions prior to 0.4.7, update to version 0.4.7 or later to resolve the issue. As a temporary workaround, consider running umoci under an LSM profile such as AppArmor or SELinux to restrict the level of access it has outside of container image directories. If using umoci as an unprivileged user with the --rootless flag, umoci will not be able to overwrite any files that the user doesn't have access to, which can serve as a mitigation.

A remote code execution risk was identified in the Shibboleth authentication plugin of Moodle. The issue is related to incorrect code generation management. An attacker can exploit this issue by sending a specially crafted request, allowing them to execute arbitrary code remotely.

The issue allows for cross-site scripting (XSS), which is a type of attack where an attacker can inject malicious scripts into a website, potentially leading to unauthorized access or control.

The issue allows Deserialization of Untrusted Data.

The issue is related to a parsing flaw in the Private Message / Post renderer, specifically a nested video MyCode issue, which can lead to persistent XSS. This allows an attacker to potentially take over any forum account.

The issue allows an attacker to create a PHP shell in the cache directory of a targeted forum via a crafted XML import. This is achieved by exploiting a default behavior of MySQL on many systems, where strings that are too long for a database column are truncated. For example, a string like `aaaaaaaaaaaaaaaaaaaaaa.php.css` can be truncated to `aaaaaaaaaaaaaaaaaaaaaa.php` due to a 30-character limit, leading to remote code execution.

The issue concerns a Stored XSS that can be triggered by utilizing the Continue Later feature to input an email address. This email address is then mishandled within the admin panel, leading to potential exploitation.

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.7.2.5 Description: The issue allows an attack in the orders section of PrestaShop after gaining access with a user role of at least a Salesman or higher privileges. The attacker can inject arbitrary PHP objects and abuse an object chain to gain Remote Code Execution. This occurs because protection against serialized objects looks for a `0:` followed by an integer, but does not consider `0:+` followed by an integer. Recommendations: For PrestaShop versions prior to 1.7.2.5, update to version 1.7.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the orders section to minimize the risk of exploitation.

The issue allows for Remote Code Execution through Object Injection by utilizing Phar deserialization. This can be achieved by passing an absolute path to a file exists check. The exploitation of this issue requires access to the Admin Control Panel with founder permissions.

An issue was discovered that allows a Teacher creating a Calculated question to intentionally cause remote code execution on the server through eval injection.

The issue allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. This is due to the improper restriction of custom envelope-from addresses on the sendmail command line when no SMTP server is configured and the sendmail program is enabled.