Stefan Schiller

The issue allows for arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. This is particularly problematic when using the CLI flag --remote-image on untrusted container images.

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 (affected versions not specified) Description: This issue allows physically present attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. The specific flaw exists within the handling of SSIDs embedded in scanned QR codes, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate content filtering in Joomla leads to multiple XSS vulnerabilities in various components. Attackers can trick administrators into clicking on a malicious link, potentially granting them full control of the website and allowing for remote code execution (RCE). The issue is estimated to affect over 2.7 million services, mainly distributed in the United States, Germany, and other countries.

The issue allows project administrators to import attachments with unrestricted URL values, potentially causing Apache Allura to read local files and expose them. This exposure can lead to other exploits, such as session hijacking or remote code execution.

The issue arises from incorrect calculations of instruction element lengths during the Guacamole protocol handshake. This could allow an attacker to inject Guacamole instructions through specially-crafted data.

The issue allows an attacker to execute arbitrary code with the privileges of the guacd process, depending on timing, as Apache Guacamole may continue to reference a freed RDP audio input buffer.

The issue allows an attacker with access to certain private information to impersonate other users.

The issue allows an attacker with admin account access to perform remote code execution (RCE) via null-byte injection.

The issue is related to insufficient comparison in the Apache OpenMeetings video conferencing software. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information.

The issue allows path traversal in HTML export, a non-default feature. Organizers can trigger the overwriting of an arbitrary file with the standard pretalx 404 page content.

The issue allows path traversal in HTML export, a non-default feature. Users can upload crafted HTML documents that trigger the reading of arbitrary files.

The issue is related to unauthenticated, stored cross-site scripting in the display of alarm reduction keys, which could allow an attacker to access confidential session information. This is due to inadequate protection of the web page structure. The exploitation of this issue may enable a remote attacker to gain unauthorized access to protected session information.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. The specific flaw exists within a shared library used by the telnetd service, which listens on TCP port 23 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

The issue allows an attacker to inject and execute PHP code in the `auth.php` and `hosttags.php` files of the watolib component, which will be executed upon request of the vulnerable component.

The issue allows an attacker to perform a limited Server-Side Request Forgery (SSRF) in the agent-receiver component, enabling communication with local network restricted endpoints through the host registration API.

The issue allows an attacker to perform direct queries to the application's core from localhost by injecting Livestatus Query Language (LQL) in the AuthUser HTTP query header.

A format string vulnerability allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.