Sergey Bobrov

Xibo is an open source digital signage platform with a web content management system (CMS). A cross-site scripting issue allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xibo Library via the Generic File module to be referenced on Displays and in Layouts. When previewing these resources from the Library and Layout editor, they are executed in the user's browser. This behavior has been changed in version 4.1.0 to disable previewing of generic files. Users are encouraged to use the new developer tools in 4.1 to design their widgets which require this type of functionality.

A cross-site scripting issue in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. This occurs when a user designs a DataSet with an HTML column containing JavaScript, which is then executed on the Data Entry page and in any Layouts referencing it. The behavior was changed in version 4.1.0 to display HTML, CSS, and JavaScript as code on the Data Entry page.

A SQL injection issue was discovered in the "report/data/proofofplayReport" API endpoint inside the Xibo content management system. This allows an authenticated user to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values into the `sortBy` parameter.

A SQL injection issue was discovered in the API routes of Xibo, a content management system, specifically in the components responsible for filtering DataSets. This allows an authenticated user to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values into the APIs for importing JSON and importing a Layout containing DataSet data.

A SQL injection issue was discovered in the API route responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values into the `formula` parameter.

A SQL injection issue was discovered in the API routes of Xibo, a content management system, specifically in the components responsible for filtering DataSets. This allows an authenticated user to obtain arbitrary data from the Xibo database by injecting specially crafted values into the API for viewing DataSet data.

This issue allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application does not properly process the `url` parameter when generating a PDF report. An authorized attacker with access to the reporting functionality could inject arbitrary commands that would be executed when the script `/script/html2pdf.sh` is called. The vulnerability can be exploited by an authorized user with network access.

A flaw was found in the Red Hat Ceph Storage RadosGW related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made. This issue is also related to insufficient input validation, which may allow a remote attacker to impact data integrity.

The issue allows for possible CRLF injection, enabling HTTP response splitting attacks for sites using mod userdir. This was mitigated by changes in versions 2.4.25 and 2.2.32, which prohibit CR or LF injection into the "Location" or other outbound header key or value.

An elevation of privilege issue in the AOSP Launcher could allow a local malicious application to create shortcuts with elevated privileges without user consent. This is a local bypass of user interaction requirements, providing access to functionality that would normally require user initiation or permission.

The issue allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies, specifically when used on a site with Google Analytics.

The issue affects the integrity of the system via vectors related to HTTP Request Handling. It is related to an error in processing the Request-URI, which can be exploited to access arbitrary scripts outside the application directory using directory traversal constructs in Windows operating systems.

The issue is related to HTTP Request Handling in the Oracle Containers for J2EE component. It allows remote attackers to affect integrity. The vulnerability is also described as being related to insufficient checking of values in HTTP headers, which can be exploited by adding special CRLF symbols to the header value, allowing an attacker to form a fake HTTP response and display arbitrary data to the user in the context of the vulnerable application.

The issue affects confidentiality and is related to HTTP Request Handling. It involves incorrect handling of a null byte in the path when forwarding a request to another static page or JSP script using functions like `pageContext.forward` or `jsp:forward`. This can disrupt the logic of script processing by global servlets, potentially allowing an attacker to form a request to process a JSP script as SHTML, thereby obtaining the script's source code. On Windows operating systems, in combination with a directory traversal vulnerability, this could lead to the execution of arbitrary commands when a file containing SHTML code is called as an SHTML script.

A cross-site request forgery (CSRF) issue exists due to improper configuration of SIMATIC HMI panels by the WinCC product, allowing remote attackers to hijack the authentication of victims.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels. This is due to an open redirect vulnerability in the affected software.

A directory traversal issue in the web server allows remote authenticated users to read arbitrary files by querying a pathname.

A cross-site scripting (XSS) issue exists in the HMI web application, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to unauthorized actions on the web application.

A cross-site scripting (XSS) issue exists in the HMI web application, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified data. This could potentially lead to unauthorized actions on the web application.

The issue allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.