Vulnerabilities

The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console.<br /> <br /> <br /> <br /> Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation phase, the parser fails to perform sufficient length validation for the incoming data block. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed data. Due to missing bounds checks, the xrdp process may read a small number of bytes beyond the declared data block boundary, potentially disclosing process memory contents that could be combined with other vulnerabilities. This issue has been fixed in version 0.10.6.1.

FreeScout is a free help desk and shared inbox built with PHP&amp;#39;s Laravel framework. Prior to version 1.8.221, FreeScout&amp;#39;s attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.

FreeScout is a free help desk and shared inbox built with PHP&amp;#39;s Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0&amp;#39;s OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim session, they can complete OAuth verification using their own OAuth identity. The victim session is then treated as recently reauthenticated, allowing freshness-protected account actions to proceed. Version 5.8.1 contains a fix for this issue.

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user&amp;#39;s browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting (XSS) vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. This issue has been fixed in version 6.0.3.

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator&amp;#39;s browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject malicious JavaScript code that is executed in the browsers of users who access the affected template.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: team: fix NULL pointer dereference in team_xmit during mode change<br /> <br /> __team_change_mode() clears team-&gt;ops with memset() before restoring<br /> safe dummy handlers via team_adjust_ops(). A concurrent team_xmit()<br /> running under RCU on another CPU can read team-&gt;ops.transmit during<br /> this window and call a NULL function pointer, crashing the kernel.<br /> <br /> The race requires a mode change (CAP_NET_ADMIN) concurrent with<br /> transmit on the team device.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> Oops: 0010 [#1] SMP KASAN NOPTI<br /> RIP: 0010:0x0<br /> Call Trace:<br /> team_xmit (drivers/net/team/team_core.c:1853)<br /> dev_hard_start_xmit (net/core/dev.c:3904)<br /> __dev_queue_xmit (net/core/dev.c:4871)<br /> packet_sendmsg (net/packet/af_packet.c:3109)<br /> __sys_sendto (net/socket.c:2265)<br /> <br /> The original code assumed that no ports means no traffic, so mode<br /> changes could freely memset()/memcpy() the ops. AF_PACKET with<br /> forced carrier breaks that assumption.<br /> <br /> Prevent the race instead of making it safe: replace memset()/memcpy()<br /> with per-field updates that never touch transmit or receive. Those<br /> two handlers are managed solely by team_adjust_ops(), which already<br /> installs dummies when tx_en_port_count == 0 (always true during mode<br /> change since no ports are present). WRITE_ONCE/READ_ONCE prevent<br /> store/load tearing on the handler pointers.<br /> <br /> synchronize_net() before exit_op() drains in-flight readers that may<br /> still reference old mode state from before port removal switched the<br /> handlers to dummies.