Shubham Shah

An issue exists in the Authentication Engine component of Oracle Access Manager. An unauthenticated attacker with network access via HTTP can compromise the system, potentially leading to unauthorized read access or the unauthorized update, insertion, and deletion of a subset of accessible data.

The application contains a pre-authentication blind Server-Side Request Forgery (SSRF) vulnerability in the `portal-settings-authentication-opensso-web` component. This is due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.

A reflected cross-site scripting (XSS) vulnerability exists that allows a remote, non-authenticated attacker to inject JavaScript. The vulnerability is located in the `modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry cover image caption.jsp` file.

Adobe Experience Manager versions 6.5.23 and earlier are affected by a misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code without user interaction. Exploitation of this issue changes the scope of access. This vulnerability is actively being exploited and a public proof-of-concept is available. The vulnerability is related to a misconfigured servlet that evaluates unvalidated OGNL expressions, potentially enabling attackers to execute arbitrary commands. The vulnerability is present when the Struts development mode is enabled.

A reflected cross-site scripting (XSS) issue exists in Liferay Portal and DXP. A remote, unauthenticated attacker can inject JavaScript code into the `/modules/apps/marketplace/marketplace-app-manager-web` component. The attacker can exploit this by crafting a malicious URL containing the injected script. When a user clicks on this link, the browser executes the script, potentially allowing the attacker to gain access to the user's session and data. The exploit involves sending a crafted request to the `/o/marketplace-app-manager-web/icon.jsp` endpoint with a malicious `iconURL` parameter. The vulnerable parameter is `iconURL`.

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and certain conditions are met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. It is estimated that over 3.1 million services are potentially affected.

The issue is related to a .NET deserialization vulnerability in the Ad Hoc Transfer module of WS FTP Server. This vulnerability can be exploited by a pre-authenticated attacker to execute remote commands on the underlying WS FTP Server operating system. The vulnerability has been observed being actively exploited in the wild, and it is estimated that a significant number of devices may be affected.

The issue is related to the incorrect management of code generation in the Metabase platform, which could allow remote code execution on the server. The core problem is that the embedded in-memory database H2 exposes ways for a connection string to include code that is then executed by the process running the embedded database. This means a user-supplied string can be used to inject executable code. The validation API, which can be called without validation, is the primary vector used for exploitation. Approximately 58,710 results are potentially affected.

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in cPanel. The issue occurs on the cpsrvd error page via an invalid webcall ID. This vulnerability can be exploited by a remote attacker to impact the confidentiality and integrity of protected information. There have been reports of hacktivists sharing attack methods and scripts to identify and exploit this vulnerability.

The issue is related to insufficient input validation in the OXI component of Oracle Hospitality OPERA 5 Property Services. This allows a remote attacker with high privileges and network access via HTTP to compromise the system. Successful attacks can result in unauthorized access to critical data, complete access to all accessible data, unauthorized updates, inserts, or deletes to some accessible data, and a partial denial of service. The vulnerability can significantly impact additional products.

The issue is related to insufficient request checking on the server side, allowing a remote, authenticated user to perform a full read server-side request forgery via a batch endpoint. This can be exploited to conduct SSRF attacks.

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk (affected versions not specified) Description: A security issue has been discovered in the SolarWinds Web Help Desk product, where hard-coded credentials allow an attacker with local access to the host machine to execute arbitrary HQL queries against the database. This enables the attacker to steal password hashes of users or insert arbitrary data into the database. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to insufficient validation of incoming requests, allowing a remote attacker to impact the confidentiality and integrity of protected information using specially crafted HTTP requests. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response. This is a Server-Side Request Forgery (SSRF) vulnerability.

An issue has been discovered where an account can be granted incorrect privileges in response to authentication that uses specific sign-on workflows.

The server in Jamf Pro has a vulnerability affecting integrity and availability. This issue allows for a Server-Side Request Forgery (SSRF) attack. Jamf Nation will also publish an article about this vulnerability.

The issue is related to an insecure deserialization attack that can lead to remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability. It is reported that the Australian Department of Defence's ForceNet platform, which uses Sitecore XP, was affected by a ransomware attack, potentially exposing 30,000 to 40,000 personal records. However, it is not confirmed if this incident is directly related to the vulnerability in question.

The issue allows local users to gain privileges via unspecified vectors due to the use of setuid-root permissions for /opt/bin/cli.

A directory traversal issue allows remote attackers to read files by crafting a URI.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the `code`, `error`, or `error description` parameters in the oauth callback.php file.

The issue is related to the Content Security Policy (CSP) implementation in the Messages component of Apple OS X. It allows remote attackers to obtain sensitive information via a javascript: URL. The vulnerability is associated with a lack of protection for sensitive data, which can be exploited by a remote attacker to gain confidential information by navigating to a JavaScript link.