Tinyb0Y

**Name of the Vulnerable Software and Affected Versions** Malcolm (affected versions not specified) **Description** The nginx Lua role-based access control (RBAC) layer fails to percent-decode the request URI before performing pattern-matching to restrict access to sensitive paths. While the RBAC gate evaluates the raw, percent-encoded string, nginx uses the percent-decoded, normalized URI to route the request to the appropriate location block. This discrepancy allows an authenticated user with low privileges to bypass access restrictions by using percent-encoding in the request URI, such as requesting `/%68tadmin.php` instead of `/htadmin.php`, to reach restricted endpoints like `/htadmin`, `/auth`, `/admin login`, `/arkime/api/esadmin`, NetBox, and upload endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Malcolm (affected versions not specified) **Description** The upload-processing pipeline in `scripts/safe-extract.py` fails to apply entry-count, nesting-depth, and total-uncompressed-byte limits when processing single-stream compressed formats such as .gz, .bz2, .xz, .lzma, and .lz that are not .tar.*-style archives. This allows an authenticated user with upload permissions for PCAP or log files to upload a highly compressible file, such as a gzip bomb (a malicious archive designed to crash a system by expanding to an enormous size), which can exhaust the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, leading to platform disruption for all users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenNMS Meridian versions prior to 2024.3.12 OpenNMS Meridian versions prior to 2025.0.9 OpenNMS Horizon versions prior to 36.0.3 **Description** A JEXL expression sandbox bypass exists in the Measurements REST API. A low-privileged authenticated user can submit a crafted expression to escape the sandbox and load arbitrary Java classes on the server. This could allow an attacker to access confidential information and compromise system integrity. JEXL (Java Expression Language) is a powerful expression language used to evaluate dynamic expressions in Java applications. **Recommendations** Upgrade to Meridian 2024.3.12 or newer. Upgrade to Meridian 2025.0.9 or newer. Upgrade to Horizon 36.0.3 or newer. Ensure the software is installed within private networks and not directly accessible from the Internet.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.58 **Description** GitPython fails to validate submodule names within `.gitmodules` files. This allows an attacker to use traversal sequences in submodule names during submodule initialization to create Git repositories at arbitrary filesystem paths outside the intended clone directory. **Recommendations** Update GitPython to version 3.1.58 or later.