Vulnerabilities

Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket.

Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: prevent mss overflow in skb_segment()<br /> <br /> Once again syzbot is able to crash the kernel in skb_segment() [1]<br /> <br /> GSO_BY_FRAGS is a forbidden value, but unfortunately the following<br /> computation in skb_segment() can reach it quite easily :<br /> <br /> mss = mss * partial_segs;<br /> <br /> 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to<br /> a bad final result.<br /> <br /> Make sure to limit segmentation so that the new mss value is smaller<br /> than GSO_BY_FRAGS.<br /> <br /> [1]<br /> <br /> general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN<br /> KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]<br /> CPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023<br /> RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551<br /> Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00<br /> RSP: 0018:ffffc900043473d0 EFLAGS: 00010202<br /> RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597<br /> RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070<br /> RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff<br /> R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0<br /> R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046<br /> FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0<br /> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> Call Trace:<br /> <br /> udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109<br /> ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120<br /> skb_mac_gso_segment+0x290/0x610 net/core/gso.c:53<br /> __skb_gso_segment+0x339/0x710 net/core/gso.c:124<br /> skb_gso_segment include/net/gso.h:83 [inline]<br /> validate_xmit_skb+0x36c/0xeb0 net/core/dev.c:3626<br /> __dev_queue_xmit+0x6f3/0x3d60 net/core/dev.c:4338<br /> dev_queue_xmit include/linux/netdevice.h:3134 [inline]<br /> packet_xmit+0x257/0x380 net/packet/af_packet.c:276<br /> packet_snd net/packet/af_packet.c:3087 [inline]<br /> packet_sendmsg+0x24c6/0x5220 net/packet/af_packet.c:3119<br /> sock_sendmsg_nosec net/socket.c:730 [inline]<br /> __sock_sendmsg+0xd5/0x180 net/socket.c:745<br /> __sys_sendto+0x255/0x340 net/socket.c:2190<br /> __do_sys_sendto net/socket.c:2202 [inline]<br /> __se_sys_sendto net/socket.c:2198 [inline]<br /> __x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198<br /> do_syscall_x64 arch/x86/entry/common.c:52 [inline]<br /> do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83<br /> entry_SYSCALL_64_after_hwframe+0x63/0x6b<br /> RIP: 0033:0x7f8692032aa9<br /> Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48<br /> RSP: 002b:00007fff8d685418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c<br /> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f8692032aa9<br /> RDX: 0000000000010048 RSI: 00000000200000c0 RDI: 0000000000000003<br /> RBP: 00000000000f4240 R08: 0000000020000540 R09: 0000000000000014<br /> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff8d685480<br /> R13: 0000000000000001 R14: 00007fff8d685480 R15: 0000000000000003<br /> <br /> Modules linked in:<br /> ---[ end trace 0000000000000000 ]---<br /> RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551<br /> Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00<br /> RSP: 0018:ffffc900043473d0 EFLAGS: 00010202<br /> RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597<br /> RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070<br /> RBP: ffffc90004347578 R0<br /> ---truncated---

MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to `control.ashx` as the victim user within MeshCentral. Version 1.1.21 contains a patch for this issue.

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.

QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available.

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the default configuration) and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and has been patched in Cilium v1.14.7. There is no workaround to this issue.

This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). <br /> <br /> Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.<br /> <br /> This Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.<br /> <br /> Atlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions<br /> <br /> See the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&amp;tab=installation).<br /> <br /> This vulnerability was reported via our Penetration Testing program.

A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.<br /> <br /> <br /> Affected Products:<br /> UniFi Access Points<br /> UniFi Switches<br /> UniFi LTE Backup<br /> UniFi Express (Only Mesh Mode, Router mode is not affected)<br /> <br /> <br /> Mitigation:<br /> Update UniFi Access Points to Version 6.6.55 or later.<br /> Update UniFi Switches to Version 6.6.61 or later.<br /> Update UniFi LTE Backup to Version 6.6.57 or later.<br /> Update UniFi Express to Version 3.2.5 or later.

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).