Taisehub

**Name of the Vulnerable Software and Affected Versions** jinjava versions prior to 2.8.1 **Description** jinjava is a Java-based template engine. A sandbox escape flaw exists due to unrestricted interaction with the properties of `JinjavaInterpreter` instances, specifically through the `ObjectMapper`. By utilizing `mapper.getTypeFactory().constructFromCanonical()`, an attacker can deserialize attacker-controlled input into arbitrary classes, bypassing sandbox restrictions. This allows instantiation of classes like `java.net.URL`, enabling access to local files and URLs. With further exploitation, this can potentially lead to remote code execution (RCE). Over 289,100 instances are potentially exposed. The vulnerability allows escaping the sandbox and creating powerful primitives for file access and potentially RCE. The issue involves traversing from the ` int3rpr3t3r ` variable to the `config` field, which exposes an `ObjectMapper`. The `JavaType` class is not restricted, allowing attackers to leverage `constructFromCanonical` to instantiate semi-arbitrary classes. **Recommendations** Update to version 2.8.1 or later.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to the latest stable, beta and tests-passed versions **Description** The issue is related to the endpoint for generating inline oneboxes for URLs, which did not enforce limits on the number of URLs accepted, allowing a malicious user to inflict a denial of service on some parts of the application. This can only be exploited by authenticated users. **Recommendations** For versions prior to the latest stable, beta and tests-passed versions, update to the latest version to resolve the issue. For users unable to update, as a temporary workaround, turn off the `enable inline onebox on all domains` site setting and remove all entries from the `allowed inline onebox domains` site setting.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to the latest version **Description** Discourse is an open source platform for community discussion. In affected versions, an attacker can make a crafted XHR request to poison the anonymous cache, which may have a response with missing preloaded data. This issue only affects anonymous visitors of the site. **Recommendations** For versions prior to the latest version, update to the latest version to resolve the issue. As a temporary workaround for users unable to upgrade, disable anonymous cache by setting the `DISCOURSE DISABLE ANON CACHE` environment variable to a non-empty value.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to the latest version **Description** Discourse is an open source platform for community discussion. In affected versions, an attacker can execute arbitrary JavaScript on users' browsers by posting a malicious video placeholder HTML element. This issue only affects sites with CSP disabled. **Recommendations** For versions prior to the latest version, update to the latest version to resolve the issue. As a temporary workaround for users unable to upgrade, enable CSP to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to the latest version **Description** Discourse is an open source platform for community discussion. In affected versions, an attacker can carefully craft a request with the right request headers to poison the anonymous cache, which may have a response with missing preloaded data. This issue only affects anonymous visitors of the site. **Recommendations** For versions prior to the latest version, users are advised to upgrade to the latest version of Discourse to resolve the issue. As a temporary workaround for users unable to upgrade, consider disabling anonymous cache by setting the `DISCOURSE DISABLE ANON CACHE` environment variable to a non-empty value.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 3.2.3 on the stable branch Discourse versions prior to 3.3.0.beta4 on the beta and tests-passed branches **Description** Discourse is an open-source discussion platform. A malicious actor could get the FastImage library to redirect requests to an internal Discourse IP. **Recommendations** For Discourse versions prior to 3.2.3 on the stable branch, update to version 3.2.3 or later. For Discourse versions prior to 3.3.0.beta4 on the beta and tests-passed branches, update to version 3.3.0.beta4 or later.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions prior to 26.0.9 and 27.1.4 Nextcloud Enterprise Server versions prior to 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 **Description** The issue is related to the lack of restrictions on authentication attempts, allowing a remote attacker to bypass the authentication process. When a (reverse) proxy is configured as a trusted proxy, the server can be tricked into reading the wrong remote address for an attacker, enabling them to execute authentication attempts. **Recommendations** For Nextcloud Server versions prior to 26.0.9, update to version 26.0.9 or later. For Nextcloud Server versions prior to 27.1.4, update to version 27.1.4 or later. For Nextcloud Enterprise Server versions prior to 23.0.12.13, update to version 23.0.12.13 or later. For Nextcloud Enterprise Server versions prior to 24.0.12.9, update to version 24.0.12.9 or later. For Nextcloud Enterprise Server versions prior to 25.0.13.4, update to version 25.0.13.4 or later. For Nextcloud Enterprise Server versions prior to 26.0.9, update to version 26.0.9 or later. For Nextcloud Enterprise Server versions prior to 27.1.4, update to version 27.1.4 or later.