Shaxriyor Abdullayev

**Name of the Vulnerable Software and Affected Versions** Redis versions prior to 8.8.2 **Description** An out-of-bounds read occurs when the `getPingExtLength()` function in the cluster bus message parser fails to validate extension length fields against the actual remaining buffer size. This allows an adjacent unauthenticated attacker to cause a denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port, forcing the parser to read beyond the allocated buffer boundary. **Recommendations** Update Redis to version 8.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** alseambusher/crontab-ui versions prior to 0.4.3 **Description** An OS command injection allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The 'POST /import' endpoint accepts arbitrary .db files and overwrites the application database without validation. Specifically, the `hook` field value is embedded directly into a shell command by the `makeCommand()` function without sanitization, leading to command execution during the next cron execution cycle. **Recommendations** Update alseambusher/crontab-ui to version 0.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** alseambusher/crontab-ui versions prior to 0.4.3 **Description** An OS command injection flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries. This occurs when a crafted GET request is sent to the '/crontab' endpoint with URL-encoded newlines in the `env vars` parameter. The handler appends the `env vars` value directly to the crontab file string as '${envVars} ' without stripping newline characters, which enables the insertion of arbitrary cron expressions that execute attacker-controlled commands. **Recommendations** Update alseambusher/crontab-ui to version 0.4.3 or later. Avoid using the `env vars` parameter in the '/crontab' endpoint until the software is updated.

**Name of the Vulnerable Software and Affected Versions** Typemill (affected versions not specified) **Description** The login endpoint 'POST /tm/login' using the `login()` function in `ControllerWebAuth` lacks rate-limiting, failed-attempt counting, and account lockout mechanisms when the captcha is disabled, which is the default setting. This allows an unauthenticated attacker to perform unlimited password-guessing attacks against any account, including those with administrator privileges, without throttling. While some lockout logic exists within the same file, it only applies to the optional secondary email-authcode verification step and not to the primary password validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.