Sebastian

Bio.Entrez in Biopython allows doctype XML External Entity (XXE), which is a technique where an XML parser is tricked into processing external entities within a document type definition, potentially leading to unauthorized access to local files or server-side request forgery.

An issue was discovered in LWsystems Benno MailArchiv, where attackers can cause cross-site scripting (XSS) via JavaScript content to a mailbox.

A CSRF issue was discovered.

The issue allows remote attackers to bypass a protection mechanism. This is achieved by exploiting the `post password` parameter.

The issue allows remote authenticated users to obtain sensitive information, including API keys, by exploiting certain API methods. Specifically, the "update repo", "get locks", and "get user groups" API methods are vulnerable.

The issue allows local users to invoke any configured PAM stack, potentially triggering unintended side effects, by passing a user-supplied argument to the pam start function within a setuid environment. This can be achieved via an arbitrary valid PAM service name. The vendor notes that the possibility of resultant privilege escalation may be unlikely.