Stsewd

**Name of the Vulnerable Software and Affected Versions** Sentry versions 10.0.0 through 24.7.0 **Description** The issue allows an unsanitized payload sent by an Integration platform integration to store arbitrary HTML tags on the Sentry side, which could be rendered on the Issues page. This creates a Stored Cross-Site Scripting (XSS) vulnerability, potentially leading to the execution of arbitrary scripts in the context of a user’s browser. Self-hosted Sentry users may be impacted if untrustworthy Integration platform integrations send external issues to their Sentry instance. **Recommendations** For self-hosted users, upgrade Sentry to the latest version. If upgrading is not possible, enable CSP on the self-hosted installation with `CSP REPORT ONLY = False` (enforcing mode) to mitigate the risk of cross-site scripting. For Sentry SaaS customers, no action is needed as the issue has been patched.

**Name of the Vulnerable Software and Affected Versions** django-wiki versions prior to 0.10.1 **Description** The issue allows maliciously crafted article content to cause severe use of server CPU through a regular expression loop. This can be exploited by anonymous users creating or editing articles. The estimated number of potentially affected devices is not specified. **Recommendations** For versions prior to 0.10.1, update to version 0.10.1 to resolve the issue. As a temporary workaround, consider closing off access to create and edit articles by anonymous users.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.37 **Description** The issue is related to GitPython's handling of file paths when resolving git references. In some cases, the library reads files from the `.git` directory based on user-provided input without checking if the file is located outside the intended directory. This allows an attacker to make GitPython read any file from the system, potentially leading to a denial of service. The vulnerability is present in the `symbolic.py` file and is caused by the code joining the base directory with a user-given string without checking the final path. **Recommendations** For versions prior to 3.1.37, update to version 3.1.37 or later to resolve the issue. As a temporary workaround, consider restricting access to the `symbolic.py` module or the affected API endpoints to minimize the risk of exploitation. Avoid using user-provided input for file paths without proper validation and sanitization.

**Name of the Vulnerable Software and Affected Versions** GitPython (affected versions not specified) **Description** The issue is related to how Python interacts with Windows systems, specifically when resolving a program. GitPython defaults to use the `git` command, and if a user runs it from a repository with a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This allows an attacker to trick a user into downloading a repository with a malicious `git` executable, enabling the attacker to run arbitrary commands. The problem is more significant on Windows systems, as Linux and other OS are not affected. **Recommendations** 1. Default to an absolute path for the git program on Windows, like `C:Program FilesGitcmdgit.EXE` (default git path installation). 2. Require users to set the `GIT PYTHON GIT EXECUTABLE` environment variable on Windows systems. 3. Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repository, or set the `GIT PYTHON GIT EXECUTABLE` env var to an absolute path. 4. Resolve the executable manually by only looking into the `PATH` environment variable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.