Vulnerabilities

Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted<br /> explicit values for the field polynomial can lead to out-of-bounds memory reads<br /> or writes.<br /> <br /> Impact summary: Out of bound memory writes can lead to an application crash or<br /> even a possibility of a remote code execution, however, in all the protocols<br /> involving Elliptic Curve Cryptography that we&amp;#39;re aware of, either only "named<br /> curves" are supported, or, if explicit curve parameters are supported, they<br /> specify an X9.62 encoding of binary (GF(2^m)) curves that can&amp;#39;t represent<br /> problematic input values. Thus the likelihood of existence of a vulnerable<br /> application is low.<br /> <br /> In particular, the X9.62 encoding is used for ECC keys in X.509 certificates,<br /> so problematic inputs cannot occur in the context of processing X.509<br /> certificates. Any problematic use-cases would have to be using an "exotic"<br /> curve encoding.<br /> <br /> The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),<br /> and various supporting BN_GF2m_*() functions.<br /> <br /> Applications working with "exotic" explicit binary (GF(2^m)) curve parameters,<br /> that make it possible to represent invalid field polynomials with a zero<br /> constant term, via the above or similar APIs, may terminate abruptly as a<br /> result of reading or writing outside of array bounds. Remote code execution<br /> cannot easily be ruled out.<br /> <br /> The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.<br /> <br /> <br /> Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers.<br /> <br /> <br /> This issue affects OpenText Application Automation Tools: 24.1.0 and below.

Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below.

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.<br /> <br /> <br /> Multiple missing permission checks - Service Virtualization config has been discovered in in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate Service Virtualization server names.<br /> <br /> This issue affects OpenText Application Automation Tools: 24.1.0 and below.

An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A<br /> malicious authenticated user with non-administrator privileges may be <br /> able to enter specially crafted SQL queries and perform unauthorized <br /> remote code execution on the HCX manager. <br /> Updates are available to remediate this vulnerability in affected VMware products.

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.