Sim4N6

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.2 through 18.8.9, 18.9 through 18.9.5, and 18.10 through 18.10.3 Description The issue involves improper input validation in GraphQL queries, potentially allowing an authenticated user to cause a denial of service to the GitLab instance. Recommendations Update to GitLab EE version 18.8.9 or later. Update to GitLab EE version 18.9.5 or later. Update to GitLab EE version 18.10.3 or later.

An unauthenticated user could potentially cause a denial of service by sending specially crafted input to a merge request endpoint. This issue involves a regular expression denial of service.

An issue has been discovered in GitLab CE/EE that allows an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition. This issue affects various versions of GitLab CE/EE, allowing an attacker to exploit it and cause a denial of service.

An issue has been discovered in GitLab CE/EE that allows attackers to bypass Device OAuth flow protections. This enables authorization form submission through minimal user interaction.

The issue concerns a vulnerability in the `valid host()` function that uses `socket.gethostbyname()`, making it susceptible to SSRF abuse via the DNS rebinding technique. This vulnerability is related to the Mobile Security Framework (MobSF), a tool for pen-testing, malware analysis, and security assessment that performs static and dynamic analysis.

A denial of service issue affects the availability of GitLab via unbounded symbol creation. This is achieved through the `scopes` parameter in a Personal Access Token.

The issue concerns an open-source project management tool that uses ** wildcard support to retrieve images from any hostname, potentially allowing an attacker to induce the server into performing requests to unintended locations.

The issue is related to the use of a regular expression with inefficient computational complexity in GitLab, a software platform based on git for collaborative code work. Exploitation of the issue could allow a remote attacker to cause a denial of service by sending a specific POST request, potentially via a large `glm source` parameter.

Name of the Vulnerable Software and Affected Versions: Yeti versions prior to 2.1.11 Description: The issue concerns a denial of service vulnerability. Remote user-controlled data tags can lead to Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks, potentially worsened by the use of special Unicode characters. Recommendations: For versions prior to 2.1.11, update to version 2.1.11 to resolve the issue. As a temporary workaround, consider restricting the use of remote user-controlled data tags until the patch is applied.

MindsDB is a platform for building artificial intelligence from enterprise data. A threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding, which can also lead to denial of service.

The issue is related to a denial of service vulnerability due to the lack of constraints on user-controlled data `profiler runs`. This allows for the allocation of resources on the server side with no limitation, potentially leading to a denial of service by remotely controlled data. The vulnerability is caused by the fact that the `profiler runs` variable is not constrained to any limitation, which would lead to allocating resources on the server side with no limitation.

The issue arises from the lack of limitation on the length of filenames and the costly use of Unicode normalization with the form NFKD under the hood of the `secure filename()` function. This can lead to an application-level denial of service when a user intentionally uploads a file or retrieves a filename with a large Unicode name.

The NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr webapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this issue may lead to a server-side denial of service.

The issue arises when an authenticated user uploads an avatar image with a large Unicode filename, leading to a server-side denial of service under Windows. This is due to the lack of limitation on the filename length and the costly use of Unicode normalization with the form NFKD on Windows OS.

The issue concerns an expression injection vulnerability in the `/mehah/otclient` "Analysis - SonarCloud" workflow, allowing an attacker to run commands remotely on the runner, leak secrets, and alter the repository using this workflow.

The issue arises from the function `lookupPreprocess()` which applies transformations to a string by disabling characters in the regex `[- .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[- .]`. This can be achieved with equivalent Unicode characters, resulting in omitted characters being reintroduced. The `lookupPreprocess()` function is used to search for themes loosely, and the actual security impact is classified as low.

The issue is related to a Post-Unicode normalization problem. This occurs when security checks are performed before Unicode normalization, allowing Unicode character equivalents to resurface after normalization.

A configuration injection occurs when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. The impact of a configuration injection may vary. Under some conditions, it may lead to command injection if there is shell code execution from the configuration file values.

The issue is related to an unsafe extraction performed using `tarfile.extractall()` from a remotely retrieved tarball, which may lead to the writing of extracted files to an unintended location. This is sometimes referred to as a TarSlip or a ZipSlip variant. An attacker may leverage this to overwrite any local file that the server process has access to. There is no risk of file exposure with this vulnerability. API Endpoints: `/<name>` Vulnerable Parameters or Variables: `name`, `file`, `original file name`, `source` Function Names: `put()`, `extractall()` The vulnerability can be exploited by crafting a malicious tarball with a filename path, such as ../../../../../../../../etc/passwd, and then serving the archive remotely, proceeding to the PUT request of the tarball through mindsdb, and overwriting the system files of the hosting server.

MindsDB is an open source machine learning platform. An unsafe extraction is being performed using `shutil.unpack archive()` from a remotely retrieved tarball, which may lead to the writing of the extracted files to an unintended location. This issue is sometimes called a TarSlip or a ZipSlip variant. Unpacking files using the high-level function `shutil.unpack archive()` from a potentially malicious tarball without validating that the destination file path remained within the intended destination directory may cause files to be overwritten outside the destination directory. An attacker could craft a malicious tarball with a filename path, such as `../../../../../../../../etc/passwd`, and then serve the archive remotely using a personal bucket `s3`, thus, retrieve the tarball through MindsDB and overwrite the system files of the hosting server.