Sagi Tzadik

An issue exists in Azure Entra ID where external initialization of trusted variables or data stores can allow an unauthorized attacker to elevate privileges locally.

An improper neutralization of special elements allows an authenticated attacker with push access to a repository to achieve remote code execution on the instance. During a `git push` operation, user-supplied push option values are not properly sanitized before being included in internal service headers. Because the internal header format uses a delimiter character (semicolon) that can also appear in user input, an attacker can inject additional metadata fields. Technical exploitation involves injecting values into the `X-Stat` header to override internal fields such as `rails env`, `custom hooks dir`, and `repo pre receive hooks`. By setting `rails env` to a non-production value, an attacker can bypass sandboxing and use `repo pre receive hooks` to execute arbitrary binaries, such as `/bin/bash`, as the git service user. On GitHub Enterprise Server, this can lead to full server compromise, including access to all hosted repositories and internal secrets. On shared infrastructure, it could allow cross-tenant exposure to millions of private repositories. It is estimated that approximately 88% of reachable GitHub Enterprise Server instances remained unpatched at the time of public disclosure.

A security issue exists in ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be exploited to inject arbitrary configuration into nginx. Successful exploitation can lead to arbitrary code execution within the context of the ingress-nginx controller and potential disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets cluster-wide. The issue stems from unsanitized mirror annotations.

A security issue exists where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This may allow a remote attacker to execute arbitrary code within the context of the ingress-nginx controller and disclose Secrets accessible to the controller. In default installations, the controller typically has access to all Secrets cluster-wide.

A security issue exists in ingress-nginx where the `auth-url` Ingress annotation can be exploited to inject configuration into nginx. Successful exploitation can lead to arbitrary code execution within the context of the ingress-nginx controller and potential disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets within the cluster. The issue is due to insufficient input validation.

A security issue exists in the ingress-nginx controller due to insufficient input validation and inadequate spatial separation. An unauthenticated attacker with network access to the pod network can send a specially crafted request to the admission webhook endpoint on port 8443. This allows the attacker to inject malicious NGINX configurations and achieve arbitrary code execution in the context of the controller. Successful exploitation can lead to the disclosure of Kubernetes Secrets accessible to the controller, which, in default installations, may include all Secrets cluster-wide, potentially granting full control over the Kubernetes cluster.

A use-after-free memory corruption issue exists in the Lua scripting engine of Redis. An authenticated user can exploit this by sending a specially crafted Lua script to manipulate the Lua garbage collector (GC), allowing them to escape the Lua sandbox and execute arbitrary code on the host system. This can lead to full host takeover, enabling attackers to steal credentials, exfiltrate data, or install malware. Approximately 330,000 Redis instances are exposed to the internet, with at least 60,000 lacking authentication, making them highly susceptible to this attack. The issue affects all versions of Redis that support Lua scripting.

The issue is related to a local privilege escalation vulnerability in Ubuntu kernels, specifically in the overlayfs `ovl copy up meta inode data` function, which skips permission checks when calling `ovl do setxattr`. This allows an attacker to execute arbitrary code or cause a denial of service. The vulnerability has been exploited in real-world incidents to achieve easy root access.

The issue is related to the overlayfs file system in Ubuntu kernels, where an unprivileged user may set privileged extended attributes on mounted files without proper security checks, potentially leading to arbitrary code execution or denial of service. This is due to a missing authorization check in the overlayfs file system.

The issue exists due to insufficient input validation in the Windows operating system's ODBC and OLE DB drivers. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

The issue exists due to insufficient input validation in the Windows operating system's ODBC and OLE DB drivers. Exploitation of this issue may allow an attacker to execute arbitrary code.

The issue is related to an information disclosure vulnerability in Microsoft Excel. It is associated with a buffer overflow in memory, which can allow an attacker to gain unauthorized access to protected information.

The issue is related to an information disclosure vulnerability in Microsoft Office. It is caused by a lack of protection for sensitive data. Exploitation of this issue may allow an attacker to disclose protected information and affect the system.

The issue is related to incorrect code generation management in Microsoft Office, which can be exploited by attackers to execute arbitrary code using a specially crafted file. This allows remote attackers to execute arbitrary code.

A remote code execution issue exists in Windows Domain Name System servers when they fail to properly handle requests. This can be exploited by a remote attacker using a specially crafted DNS request, allowing them to execute arbitrary code. The vulnerability is also known as 'Windows DNS Server Remote Code Execution Vulnerability' and has been present for 17 years, affecting Windows DNS Servers from 2013 to 2019 editions. It is a 'wormable' bug, enabling attackers to launch malware attacks that can spread from one vulnerable computer to another without human interaction.

The issue is related to SQL Injection. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.