Vitaly Simonovich

Processing maliciously crafted web content may disclose sensitive user information due to a cross-origin issue. This is caused by insufficient tracking of security origins, which are the sets of origins that are allowed to access resources from a specific origin.

An invalid zone might pass ZONEMD validation when the ZoneToCache is configured to use ZONEMD validation. ZONEMD is a mechanism used to verify the integrity of a DNS zone.

An attacker can send a crafted EDNS OPT record that bypasses DNSdist filtering rules. When EDNS Client Subnet is inserted, the record is rewritten as a valid OPT record, allowing the backend to receive EDNS options that were intended to be filtered.

A flaw in the Node.js Permission API allows a local server to be started via a Unix domain socket, bypassing the requirement for the `--allow-net` permission.

The cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialize PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend, such as the file system or the `sys registry` database table, can inject a crafted serialized payload to trigger PHP Object Injection. This may allow the exploitation of a gadget chain to achieve Remote Code Execution.

Processing maliciously crafted web content may disclose sensitive user information.

Processing maliciously crafted web content may lead to an unexpected process crash. The issue is caused by insufficient input validation.

Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling.

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend. This process leads the backend to update its configuration to an invalid state, resulting in a denial of service where the backend is unable to run upon the next restart and requires manual intervention to resolve.

An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.

Unsafe handling of symbolic links during the extraction of .tar and .tar.gz archives allows attackers with Item/Configure permission, or those who can control agent processes, to write files to arbitrary locations on the filesystem. This action is restricted only by the file system access permissions of the user running Jenkins. Such a flaw could enable the deployment of malicious scripts or plugins on the Jenkins controller, potentially leading to unauthorized code execution.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A flaw exists in Blink, a component of Google Chrome, that could allow a remote attacker to read memory outside of allocated boundaries. This issue occurs when processing a specially crafted HTML page. The security severity is considered low. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

A flaw in MongoDB’s OP COMPRESSED handling allows unauthenticated attackers to crash servers with minimal traffic. The issue arises because MongoDB allocates approximately 48MB of memory per connection before validating decompression parameters. Attackers can send crafted packets, around 47KB in size, with manipulated uncompressedSize values, triggering rapid memory exhaustion. Concurrent connections can lead to out-of-memory kills and service disruption. This vulnerability affects deployments with compression enabled, which is the default setting since version 3.6, including MongoDB Atlas. Approximately 207,000 instances are potentially exposed. The attack involves sending a zlib-compressed packet claiming a larger uncompressed size to cause excessive memory allocation.

A flaw exists in TYPO3 that allows local users with write access to the spool directory to execute arbitrary PHP code on the web server. This is possible by crafting a malicious file that is deserialized during the `mailer:spool:send` command.

A flaw exists where hostname verification is ignored when configured through the `verifyHostName` attribute of the '<Ssl>' element. This occurs even if the attribute is explicitly set, leaving TLS connections susceptible to interception. A network-based attacker could perform a man-in-the-middle attack if an SMTP, Socket, or Syslog appender is used, TLS is configured via a nested '<Ssl>' element, and the attacker possesses a certificate issued by a CA trusted by the configured or default Java trust store.

Using the `wordexp` function with `WRDE REUSE` and `WRDE APPEND` together in the GNU C Library can lead to the function returning uninitialized memory in the `we wordv` member. Subsequent calls to `wordfree` may then cause the process to terminate.