ubports lomiri-download-manager: Permissions, licensing, and access control issues

The ubports lomiri-download-manager version from 0.1.0 to 0.3.3 had vulnerabilities related to permission management and access control. These vulnerabilities stemmed from incorrect DBus policies in the lomiri-upload-manager component, allowing any user to read arbitrary files with root privilege...

Nezhahq Nezha resource management error vulnerability

Versions of Nezhahq Nezha from 2.0.13 to 2.3.15 have a resource management vulnerability. This vulnerability stems from the lack of restrictions on concurrent connections at the/api/v1/ws/transfer WebSocket endpoint. Authorized attackers can create numerous ServerTransferClass.Subscribe...

Nezhahq Nezha: Input validation error vulnerability

Versions of Nezhahq Nezha from 2.1.0 to 2.3.15 had a vulnerability related to input validation errors. This vulnerability occurred because the mintTransferTool never validated the construction of Host headers for the fs.downloadurl and fs.uploadurl URLs. This could allow attackers to redirect fil...

MZ Automation GmbH libIEC61850 Digital Error Vulnerability

MZ Automation GmbH’s libIEC61850 versions prior to 1.6.2 have security vulnerabilities. These vulnerabilities stem from the MMS file service accepting an excessive initialPosition during fileOpen and saving it to the file read state. The fileRead path uses unsigned arithmetic to subtract the larg...

Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

CoAI.Dev path traversal vulnerability

CoAI.Dev 4.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from unvalidated path traversal vulnerabilities in the endpoints for generating and archiving articles. Attackers can use hash query parameters to download arbitrary .tar.gz or .zip files, including...

WordPress ELEX – WordPress HelpDesk & Customer Ticketing System: Arbitrary File Upload Vulnerability

WordPress ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.7 and earlier have an arbitrary file upload vulnerability. This vulnerability stems from the initMailPart function, which does not properly validate the file type when saving IMAP email attachments. This allows unauthorize...

DoubleScale CRM arbitrary file upload vulnerability

DoubleScale CRM versions 1.5.1 and earlier have a vulnerability related to arbitrary file uploads. This vulnerability stems from the storeupload function, which allows for arbitrary file uploads. The extensionisallowed function, which is responsible for checking whether files with unrecognized...

Javahuang SurveyKing Authorization Issue Vulnerability

Javahuang SurveyKing versions prior to 1.13.0 have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification. Unverified attackers can download any stored file through the GET /api/public/preview/attachmentId interface. They can also bypass the...

Groundhogg path traversal vulnerability

Groundhogg versions 4.9.3 and earlier have a path traversal vulnerability. This vulnerability stems from insufficient file path validation in the copyfile function. As a result, authenticated attackers with access levels of Sales Representative or higher, or those who have the ability to import...

5rahim Seanime command injection vulnerability

The 5rahim Seanime version from 3.7.0 to 3.10.3 has a command injection vulnerability. This vulnerability arises due to improper authorization; unauthenticated LAN or Tailnet clients can bypass the media stream settings. By using the transcodeHwAccelCustomSettings field, they can append...

Astra Linux – Vulnerability in libass

A stack overflow occurred in the parsetag function in libass/assparse.c in libass before version 0.15.0. This vulnerability allows remote attackers to cause a denial of service or remote code execution through a crafted file...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSETMAX Dan Aloni reports: Due to commit 8cfb9015280d “NFS: Always provide aligned buffers to the RPC read layers” on the client, a read of 0xfff is aligned up to server rsize of 0x1000. As a...

Astra Linux – Vulnerability in gdcm

There is an out-of-bounds write vulnerability in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Vim

Vim is an open-source command-line text editor. From version 9.2.0320 to 9.2.0679, a crafted undo or swap file could store a virtual-text property whose offset and length points outside the line’s property data. When Vim restores or displays such a line, it converts the offset into a pointer and...

Astra Linux – vulnerability in Rails

Active Storage enables users to attach cloud and local files to Rails applications. In versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage’s DiskServicepathfor fails to validate whether the resolved filesystem path remains within the storage root directory. If a blob key containing pa...

Astra Linux – vulnerability in golang-1.23

The “go tool pack” subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. Extracting a malicious archive file using the “pack” subcommand can write files to arbitrary locations on the filesystem...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: A fix was made to perform a sanity check on the destination blkaddr during recovery. As Wenqing Liu reported in Bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=216456 loop5: A change in capacity was detected, from 0...

Astra Linux – Vulnerability in firejail

A privilege context switching issue was discovered in the join.c file of Firejail 0.9.68. By creating a fake Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment where the Linux user namespace remains the initial user...

Astra Linux – Vulnerability in exempi

The XMP Toolkit SDK version 2021.07 and earlier is affected by a stack-based buffer overflow vulnerability that may lead to arbitrary code execution within the context of the current user. Exploitation requires user interaction—that is, the victim must open a specially crafted file...