Sebastian Neef

The issue concerns a lack of validation for a parameter, which could allow users with the administrator role to perform a Server-Side Request Forgery (SSRF) attack in Multisite WordPress configurations. This could potentially lead to file read vulnerabilities. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue allows users with the administrator role to perform Local File Inclusion (LFI) attacks in the context of Multisite WordPress sites. This is due to the plugin not validating user input before using it to generate paths passed to include function/s.

The issue allows remote code execution via the backup functionality in the web frontend. An attacker with network access can exploit this to gain root access on the gateway.

The issue allows for unauthenticated path traversal, enabling an attacker to download the application database. This can potentially be combined with other exploits for further access.

The issue allows for authenticated remote code execution through the backup functionality of the web frontend.

The issue allows local privilege escalation via a race condition in logrotate. An attacker with access to the network can exploit this to gain root access on the gateway.

The issue allows an attacker with network access to gain root access on the gateway by exploiting a passwordless ftp ssh user through an exploit chain.

A buffer overflow issue exists, potentially allowing an attacker to crash the program or gain code execution through a specially crafted file. This issue is related to the `add param to argv` function in `xshared.c`.

Name of the Vulnerable Software and Affected Versions: nanosvg library versions after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 Description: The issue affects the nanosvg library, which is part of an SVG processing library. It is caused by a buffer overflow in the `nsvg parseColorRGB` function, located in src/nanosvg.h at line 1227. This can lead to memory corruption, resulting in at least a denial of service (DoS). The attack vector depends on the library's usage, and if input is passed from the network, network connectivity is sufficient for an attack. Most likely, an attack will require opening a specially crafted .svg file. Recommendations: For versions after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726, as a temporary workaround, consider disabling the `nsvg parseColorRGB` function until a patch is available. Restrict access to the library when processing untrusted SVG files to minimize the risk of exploitation. Avoid using the library to process .svg files from untrusted sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A Cross-Site Scripting issue was discovered in atvise scada, which may allow remote code execution.