Thomas Chauchefoin

The `ScopingHttpClient` component in Symfony HttpClient merges default scope options, such as `auth bearer` or `auth basic`, into a request before resolving a relative URL against the `base uri`. This allows a network-path reference to be sent to a different origin while retaining the default scope credentials, potentially disclosing them to an attacker-controlled server. This occurs when the resolved URL falls outside the origin of the base URI, including cases with different ports or user-info on the same host. The issue is reachable if an attacker controls the beginning of a URL passed to a client configured with a `base uri` and credentials, specifically those created via `HttpClient::createForBaseUri()` or configured under `framework.http client.scoped clients`.

Fickling, a Python pickling decompiler and static analyzer, incorrectly classifies pickles utilizing Python’s `runpy.run path()` or `runpy.run module()` as SUSPICIOUS instead of OVERTLY MALICIOUS. This misclassification can occur when a user relies on Fickling’s output to determine the safety of pickle deserialization, potentially leading to the execution of attacker-controlled code. This issue impacts any workflow or product that uses Fickling as a security gate for pickle deserialization.

The issue allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component. This affects products that are no longer supported by the maintainer. The problem has been reportedly exploited in real-world attacks.

The Zscaler Client Connector for macOS did not sufficiently validate RPC clients, allowing a local adversary without sufficient privileges to potentially shutdown the Zscaler tunnel by exploiting a race condition.

The issue is related to insufficient input validation in Visual Studio Code, allowing an attacker to execute arbitrary code using a specially crafted file.

The issue is related to argument injection during the tagging of a new release. This could allow a remote attacker to disclose protected information. Unprivileged user accounts with at least one SSH key can read arbitrary files on the system, potentially leaking configuration files with database credentials, such as `[database]` and `[security] SECRET KEY`, as well as exfiltrating TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.

The vulnerability in Visual Studio Code is related to insufficient input validation. Exploitation of this issue may allow a remote attacker to execute arbitrary code.

The issue is related to the `VcsDriver::getFileContent` method in Composer, a dependency manager for PHP. If a user can control the `$file` or `$identifier` argument, it may lead to a code injection vulnerability. This vulnerability can be exploited on platforms like packagist.org, where the `readme` field in composer.json can be used to inject parameters into hg/Mercurial via the `$file` argument or into git via the `$identifier` argument. To the best of our knowledge, this vulnerability was not actively exploited. The vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.

The issue is related to improper access control in the setup.php file of Zabbix Frontend, allowing unauthenticated users to access certain setup steps that should only be accessible by super-administrators. This could potentially enable a malicious actor to change the configuration of Zabbix Frontend.

The issue is related to incorrect code generation management in the Visual Studio Code editor. Exploitation of this issue may allow an attacker to execute arbitrary code.

Cachet is an open source status page system. Authenticated users, regardless of their privileges, can exploit a new line injection in the configuration edition feature and gain arbitrary code execution on the server. This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.

Cachet is an open source status page system. Authenticated users, regardless of their privileges, can trick Cachet and install the instance again, leading to arbitrary code execution on the server. This issue was addressed by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. As a workaround, only allow trusted source IP addresses to access the administration dashboard.

An issue was discovered where Views/PrivateMessages/View.cshtml does not call `HtmlUtils.SanitizeHtml` on a private message, potentially leading to issues with private message handling.

An issue was discovered where the Views/Boards/Partials/ ForumPost.cshtml file does not call `HtmlUtils.SanitizeHtml` on certain text for a forum post, potentially leading to issues with unsanitized text.

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.11 Description: The issue concerns the Twig processing of static pages in Grav, a file-based Web-platform. Any administrative user allowed to create or edit pages can enable Twig processing in the front matter. Since the Twig processor runs unsandboxed, this behavior can be exploited to gain arbitrary code execution and elevate privileges on the instance. Recommendations: For versions prior to 1.7.11, update to version 1.7.11 to address the issue. As a temporary workaround, consider blocking access to the `/admin` path from untrusted sources to reduce the probability of exploitation. After updating, consider configuring the `system.twig.safe functions` and `system.twig.safe filters` options to manually allow arbitrary PHP functions and filters.

The issue is related to the incorrect handling of module loading in the modprobe child process, allowing a local non-root attacker to exploit the MODPROBE OPTIONS environment variable and read arbitrary root files. This is a privilege escalation vulnerability.

The issue is related to the SAML SSO authentication in Zabbix. When SAML SSO authentication is enabled, a malicious actor can modify session data because the user login stored in the session is not verified. This can allow an unauthenticated actor to escalate privileges and gain admin access to Zabbix Frontend. The attack requires SAML authentication to be enabled, and the actor must know the username of a Zabbix user or use the guest account, which is disabled by default.

The issue concerns the wp-google-maps plugin for WordPress, where the REST API in includes/class.rest-api.php does not properly sanitize field names before executing a SELECT statement.

The issue is related to a command injection vulnerability in the PHP connector of elFinder.

Name of the Vulnerable Software and Affected Versions: Jenkins Job Import Plugin versions 2.1 and earlier Description: The issue allows attackers with control over the HTTP server queried in preparation of job import to read arbitrary files and perform a denial of service attack. This is due to an XML external entity processing vulnerability in the src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java file. Recommendations: For Jenkins Job Import Plugin versions 2.1 and earlier, update to a version later than 2.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.