qubes-core-admin

Qubes core, version 3 Ceci est la branche master du core de Qubes OS. La documentation de l'API est disponible : https://dev.qubes-os.org/projects/core-admin/en/latest/...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through the getUserByOIDCToken process in FacebookProvider.php. An attacker can impersonate a victim account by replaying a captured, valid Facebook OIDC idtoken to userFromToken without providing a matching session nonce...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the traceevents.createTracing.enable function. An attacker can write trace logs outside the intended file system boundaries by exploiting insufficient enforcement of the permission model. Remediation A fix wa...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the BGR decoder due to missing end-of-file checks. An attacker can access sensitive information from adjacent memory by submitting a specially crafted image file. Remediation A fix was pushed into the master branch...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the zipx.Unzip process. An attacker can overwrite arbitrary files on macOS APFS by crafting a ZIP archive that exploits Unicode normalization collisions and symlink following, allowing the attacker to control file...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via THeaderTransport::readString in the header parsing path. An attacker can trigger the flaw by sending a crafted THeader frame with an info-header string length that exceeds the bytes remaining in the header section...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the HTML encoding. An attacker can execute arbitrary code by supplying specially crafted input that is not properly sanitized. Remediation A fix was pushed into the master branch but not y...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to an incomplete fix in the policy. An attacker can gain unauthorized access to restricted functionality or data by bypassing intended security policies. Remediation A fix was pushed into the master branch bu...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through modRMRequired and decode in arch/X86/X86DisassemblerDecoder.c. An attacker can crash any application using a reduced X86 Capstone build by supplying crafted x86/x86-64 input containing a 3DNow! opcode...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the imageurl parameter in the chat completions endpoint. An attacker can access internal services and cloud metadata endpoints by supplying a crafted URL that redirects to internal addresses, as...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the vvdecpushdata2 function. An attacker can cause an out-of-bounds heap read by supplying a crafted HEIF file with a VVC track that exploits an integer overflow in the security check, bypassing intended...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the ProxyCommand process when a malicious username is expanded through %r, which can inject shell metacharacters, expose environment...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the ProxyCommand process. An attacker can disrupt local system availability by triggering an unchecked fork failure, which causes signals to be sent across the process tree. This is only exploitable if the...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the SSHMSGCHANNELOPEN process. An attacker can cause the system to enter an infinite loop and exhaust CPU resources by advertising a zero maximum packet size during channel establishment. Remediation A fix was pushed...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the hough lines. An attacker can cause increased memory consumption by triggering a failure during this operation. Remediation A fix was pushed into the master branch but not yet...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the TIFF encoder when a temporary file cannot be created. An attacker can cause a small memory leak by triggering conditions where the encoder attempts to create a temporary file and...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the ASHLAR coder when an action fails. An attacker can exhaust memory resources and cause service disruption by repeatedly triggering failed actions. Remediation A fix was pushed int...