Yaniv Nizry

When configured to store objects locally, the software allows an attacker to create a file via the `CreateResource` endpoint. This is achieved by including a path traversal sequence in the file name, enabling arbitrary file write on the server.

Memos version 0.22 is susceptible to Stored Cross-Site Scripting (XSS) through the upload attachment and user avatar features. The software does not validate the content type of uploaded data before serving it, potentially allowing an authenticated attacker to elevate privileges when the stored XSS is viewed by an administrator.

The issue allows an attacker to gain access to sensitive information through path traversal at the "/admin/compass" API endpoint. This vulnerability is related to errors in handling relative paths to directories, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

The issue allows for reflected XSS via the "/admin/compass" API endpoint. By manipulating an authenticated user to click on a link, arbitrary JavaScript code can be executed.

The issue allows an authenticated user to bypass file type verification when uploading a file via the "/admin/media/upload" endpoint. This can lead to the upload of a web shell, resulting in arbitrary code execution on the server. The vulnerability is being actively exploited.

The issue is a Cross-Site Request Forgery (CSRF) that affects the Flask endpoints. This allows for unauthorized requests to be made on behalf of the user.

The issue allows for Cross Site Scripting (XSS) via the `/update` endpoint. This affects products that are no longer supported by the maintainer.

The issue is related to the built-in command line interface (CLI) of the Jenkins server, which has a weakness in its authentication procedure. This weakness can be exploited by a remote attacker to perform a cross-site WebSocket hijacking (CSWSH) attack, allowing the execution of CLI commands on the Jenkins controller. The vulnerability is due to the lack of origin validation of requests made through the CLI WebSocket endpoint.

The issue arises from incorrect handling of DOM processing instructions, allowing bypassing of the cross-site scripting mechanism of typo3/html-sanitizer.

The issue involves the need for stronger revision number limitations on file serving endpoints to enhance cache poisoning protection. This is a measure to improve security against potential cache poisoning attacks, which could compromise the integrity of cached data.

The issue arises from an encoding problem in the serialization layer of TYPO3 HTML Sanitizer, allowing malicious markup nested in a `noscript` element to bypass the cross-site scripting mechanism. The `noscript` element is disabled by default but may be enabled in custom configurations. This enables the bypassing of the cross-site scripting protection provided by TYPO3 HTML Sanitizer.

The issue exists because the application allows a user to control the path of the folder to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. This can lead to unauthenticated arbitrary folder creation, and potentially to remote code execution (RCE).

A deserialization issue in the inikulin replicator allows remote attackers to run arbitrary code via the `fromSerializable` function in the `TypedArray` object.

The issue concerns the mishandling of backslash characters in certain URI schemes, such as `http:/`, which can lead to incorrect interpretation of the URI as a relative path. This can result in hostname spoofing when using affected versions to determine a URL's hostname. Impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior, depending on library usage and attacker intent. For example, a URL like `https:/expected-example.com/path` can be used to bypass security decisions.

A mutation XSS affects users calling `bleach.clean` with specific allowed tags and the keyword argument `strip comments=False`. This issue may allow a remote attacker to impact the confidentiality and integrity of protected information. The affected tags include `svg`, `math`, `p`, `br`, `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp`. Note that none of these tags are in the default allowed tags and `strip comments` defaults to `True`.

The issue is an open redirect vulnerability that could cause the Jupyter server to redirect the browser to a different malicious website. All Jupyter servers running without a base url prefix are technically affected. However, these maliciously crafted links can only be reasonably made for known Jupyter server hosts. A link to a Jupyter server may appear safe but ultimately redirect to a spoofed server on the public internet.

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

A mutation XSS issue affects users calling `bleach.clean` with specific settings, including whitelisting `svg` or `math` tags, allowing RCDATA tags, and setting the `strip` keyword argument to `False`. This could potentially allow a remote attacker to impact data integrity.

The issue exists due to inadequate protection of web page structure. Exploitation can allow a remote attacker to conduct a cross-site scripting (XSS) attack. A mutation XSS affects users calling `bleach.clean` with `noscript` and a raw tag in the allowed/whitelisted tags option.