PHP: уязвимости стека · Страница 171

baserCMS OS command injection vulnerability in Installer

baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.

• Обновитесь до 5.0.9

baserCMS Cross-site Scripting vulnerability in Site search Feature

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.

• Обновитесь до 5.0.9

Path Traversal in TYPO3 Core

Due to a too loose type check in an API method, attackers could bypass the directory traversal check by providing an invalid UTF-8 encoding sequence.

• Обновитесь до 6.2.29
• Обновитесь до 7.6.13
• Обновитесь до 8.4.1

CVE-2024-26483

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.

• Обновитесь до 3.10.0.1
• Обновитесь до 3.6.6.5
• Обновитесь до 3.7.5.4
• Обновитесь до 3.8.4.3
• Обновитесь до 3.9.8.1
• Обновитесь до 4.1.1

CVE-2024-26481

Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.

• Обновитесь до 3.10.0.1
• Обновитесь до 3.6.6.5
• Обновитесь до 3.7.5.4
• Обновитесь до 3.8.4.3
• Обновитесь до 3.9.8.1
• Обновитесь до 4.1.1

CVE-2024-25876

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.

CVE-2024-25875

A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.

CVE-2024-25874

A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.

CVE-2022-25377

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)

• Обновитесь до 0.12.2

php-svg-lib lacks path validation on font through SVG inline styles

php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other lib

• Обновитесь до 0.5.0-3+deb12u1
• Обновитесь до 0.5.2

MantisBT Host Header Injection vulnerability

MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define `$g_path` as appropriate in `config_inc.php`.

• Обновитесь до 2.26.1

Torrentpier 2.4.1 - RCE

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization.

Prestashop vulnerable to path disclosure in JavaScript variable

PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.

• Обновитесь до 8.1.4

Msa-24-0006: idor on dashboard comments block

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).

• Обновитесь до 4.1.9
• Обновитесь до 4.2.6
• Обновитесь до 4.3.3

Msa-24-0005: csrf risk in language import utility

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

• Обновитесь до 4.1.9
• Обновитесь до 4.2.6
• Обновитесь до 4.3.3

Msa-24-0004: forum export did not respect activity group settings

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.

• Обновитесь до 4.1.9
• Обновитесь до 4.2.6
• Обновитесь до 4.3.3

Msa-24-0003: h5p attempts report did not respect activity group settings

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

• Обновитесь до 4.1.9
• Обновитесь до 4.2.6
• Обновитесь до 4.3.3

Msa-24-0002: forum search accepted random parameters in its url

The URL parameters accepted by forum search were not limited to the allowed parameters.

• Обновитесь до 4.1.9
• Обновитесь до 4.2.6
• Обновитесь до 4.3.3

Msa-24-0001: denial of service risk in file picker unzip functionality

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

• Обновитесь до 4.1.9
• Обновитесь до 4.2.6
• Обновитесь до 4.3.3

Pimcore Host Header Injection in user invitation link

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POS

• Обновитесь до 1.3.4