Sina Kheirkhah

Network-adjacent attackers can execute arbitrary code on affected devices without authentication. The flaw resides in the SSH service due to the use of hard-coded credentials, allowing code execution in the context of the `telechips` user.

A local privilege escalation flaw exists in the Fiv service due to an exposed dangerous method. An attacker who has already obtained the ability to execute low-privileged code on the system can leverage this issue to escalate their privileges and execute arbitrary code with root permissions.

A missing filepath validation in the font processing feature of the DataHub module allows unauthenticated attackers to read arbitrary files from the server filesystem via a crafted request. This path traversal weakness can be used to disclose sensitive server files, such as authentication credentials, potentially leading to full unauthorized access to the application.

A missing filepath validation issue exists in the database download feature within the DataHub module. This path traversal weakness allows unauthenticated attackers to read arbitrary files from the server filesystem by sending a crafted request, potentially disclosing sensitive information such as authentication credentials and enabling unauthorized application access.

A missing filepath validation issue exists in the file upload functionality within the DataHub module. Authenticated attackers can use a crafted filename to perform path traversal, allowing them to access directories outside the intended scope and execute arbitrary commands with high privileges on the server.

A missing filepath validation issue exists in the SVG processing feature within the DataHub module. This path traversal weakness allows unauthenticated attackers to read arbitrary files from the server filesystem by sending a crafted request, potentially disclosing sensitive information such as authentication credentials and enabling unauthorized application access.

An OS command injection flaw in the API of Progress ADC products allows an unauthenticated remote attacker to execute arbitrary commands as root on the LoadMaster appliance. The issue stems from unsanitized input in multiple command endpoints. Specifically, the `escape quotes()` function in the `/accessv2` endpoint uses `malloc()` instead of `calloc()`, resulting in uninitialized heap memory, and fails to append a null terminator to the output string. This allows an attacker to read past the buffer boundary and inject shell commands into a `system()` call via the `apiuser` variable. Over 100,000 deployments are estimated worldwide, and active exploitation has been observed, including nearly 300 instances exposed online.

An exposed dangerous method or function in the server package allows remote attackers to obtain user credentials from the edge server.

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 26.3 Description A blind server-side request forgery (SSRF) vulnerability exists in legacy connection methods of document co-authoring features. An unauthenticated attacker can cause the server to send HTTP GET requests to arbitrary URLs. Recommendations Update M-Files Server to version 26.3 or later.

Name of the Vulnerable Software and Affected Versions: SmarterTools SmarterMail versions prior to build 9511 Description: SmarterTools SmarterMail contains an authentication bypass vulnerability in the password reset API. The `force-reset-password` endpoint at `/api/v1/admin/force-reset-password` permits anonymous requests and does not verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator `username` and a new `password` to reset the account, resulting in full administrative compromise of the SmarterMail instance. SmarterMail system administrator privileges grant the ability to execute operating system commands. This vulnerability has been actively exploited in the wild, with reports of Warlock ransomware operators gaining access and moving laterally through networks. Approximately 6,000 instances were identified as potentially vulnerable. Exploitation involves resetting admin passwords and leveraging built-in features for remote code execution. Recommendations: Upgrade to build 9511 or later immediately. Restrict API access via IP allowlisting. Deploy a Web Application Firewall (WAF) for the `/force-reset-password` endpoint. Implement geo-blocking for admin interfaces. Review access logs for external POST requests, unauthorized admin changes, and new account creations. Rotate exposed credentials.

An unauthenticated remote code execution flaw exists in the BI Publisher Integration component of Oracle Concurrent Processing. The issue stems from authentication and authorization deficiencies, allowing an attacker to compromise the system by sending specially crafted HTTP requests. Specifically, the exploitation targets the XML Publisher Template Manager via the `/OA HTML/RF.jsp` and `/OA HTML/OA.jsp` endpoints. Attackers can upload a malicious XSLT template that executes embedded commands when previewed, enabling the deployment of web shells and backdoors. Real-world exploitation has been attributed to threat actors including Cl0p, Scattered LAPSUS$ Hunters, and GRACEFUL SPIDER. It is estimated that over 40 organizations have been confirmed as victims, with potentially more than 100 affected. Notable victims include Harvard University, The Washington Post, Logitech, and Korean Air. These attacks primarily focused on the massive theft of corporate financial data, intellectual property, and employee records for extortion purposes.

Fortinet FortiSIEM is affected by an improper neutralization of special elements used in an OS command, also known as OS Command Injection (CWE-78). This allows an unauthenticated attacker to execute arbitrary code or commands via crafted CLI requests. Active exploitation of this issue has been confirmed, and exploit code is publicly available. The vulnerability impacts the phMonitor port (TCP/7900). There have been reports of brute-force attacks targeting Fortinet products preceding exploitation of this flaw.

This issue allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices without authentication. The flaw resides within the firmware update process due to insufficient validation of user-supplied strings before they are used in system calls, enabling an attacker to execute code with root privileges.

Dell Unity and UnityVSA contain an Improper Neutralization of Special Elements used in an OS Command vulnerability, also known as OS Command Injection. An unauthenticated, remote attacker could potentially exploit this issue to execute arbitrary commands on the system. The vulnerability stems from improper handling of login redirect URIs, allowing an attacker to insert shell metacharacters into a command execution string during the redirect process. This could lead to unauthorized configuration changes, data access, or complete control over the appliance.

A reflected cross-site scripting (XSS) vulnerability exists in the web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. Cross-site scripting (XSS) is a type of security flaw that allows attackers to inject malicious scripts into web pages viewed by other users.

A heap-based buffer overflow exists in the web interface. This allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) or potentially achieve code execution.

A stack-based buffer overflow vulnerability in the web interface allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) or potentially achieve code execution.

A local privilege escalation vulnerability allows arbitrary code execution.

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An unauthenticated adjacent attacker can configure a new OCPP backend due to insecure defaults for the configuration interface. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The flaw exists within the Tuya communications module software, resulting from the exposure of a method that allows the upload of crafted software images to the module. An attacker can leverage this issue to execute code in the context of the device.