Tony Torralba

A SQL injection issue may lead to arbitrary file write by using a SQL injection stacked queries payload and the ATTACH DATABASE command. Attackers may be able to access and modify any data stored in the database, including performance profiles, Meshery application data, or Kubernetes configuration. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API endpoint "/api/system/meshsync/resources/kinds". The `order` query parameter is directly used to build a SQL query in `meshync handler.go`.

A SQL injection vulnerability may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Attackers may be able to access and modify any data stored in the database, like performance profiles, Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API endpoint "/api/v2/events". The `sort` query parameter read in `events streamer.go` is directly used to build a SQL query in `events persister.go`.

Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL "/api/admin". The "emoji/delete" endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The `name` parameter is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory.

A SQL injection issue allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. This affects Meshery's ability to manage Kubernetes-based infrastructure and applications securely.

The issue concerns a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers can trick clients into communicating with a malicious server, including specially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on.

The issue allows attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted webhook payload. This is possible because the plugin trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs.

The Aerospike Java client has a vulnerability related to the deserialization of Java objects received from the server. Attackers can trick clients into communicating with a malicious server, which can include crafted objects in its responses that force the client to execute arbitrary code when deserialized. This can be abused to take control of the machine the client is running on. The issue is related to the `ObjectInputStream` used in the `Buffer.bytesToObject` method, which deserializes objects from the message bytes without proper validation.

The issue allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. This is due to the plugin not configuring its XML parser to prevent XML external entity (XXE) attacks.

The issue allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system. This is due to the lack of restriction on the path of attached files in the Polyspace Notification post-build step.

The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction on the AWS SQS queue name path parameter in an HTTP endpoint.

The ownCloud Android app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. These bypasses may lead to information disclosure when uploading the app's internal files and to arbitrary file write when uploading plain text files, although this is limited by the .txt extension.

The ownCloud Android app is affected by a SQL injection issue in `FileContentProvider.kt`, which can lead to information disclosure. Two databases, `filelist` and `owncloud database`, are impacted. Although the `filelist` database was deprecated in version 3.0, injections affecting `owncloud database` remain relevant as of version 3.0.

The issue arises from the way Apache OFBiz handles URLs provided by external, unauthenticated users, making it vulnerable to Regular Expression Denial of Service (ReDoS).

The issue is related to a Regular Expression Denial of Service (ReDoS) in the way Apache Tapestry handles Content Types. Specially crafted Content Types can cause catastrophic backtracking, taking exponential time to complete, due to the regular expression used on the parameter of the `org.apache.tapestry5.http.ContentType` class. This vulnerability cannot be triggered by web requests in Tapestry code alone and would only occur if non-Tapestry code passes outside input to the `ContentType` class constructor.

The issue is related to a security problem, but details are not provided.

The issue allows for local code execution due to insufficient checks when getting the project from VCS.

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2020.6.8801 Description: The issue concerns information disclosure in an issue preview. Recommendations: For versions prior to 2020.6.8801, update to version 2020.6.8801 or later to resolve the issue.