Dxleryt

**Name of the Vulnerable Software and Affected Versions** PX4 autopilot versions prior to 1.17.0-rc2 **Description** A logic error exists in the PX4 Autopilot MAVLink FTP session validation. The validation uses incorrect boolean logic (&& instead of ||), allowing `BurstReadFile` and `WriteFile` operations to proceed with invalid sessions or closed file descriptors. This allows an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. The vulnerable component is the MAVLink FTP session validation logic. **Recommendations** Update to version 1.17.0-rc2 or later.

**Name of the Vulnerable Software and Affected Versions** PX4 autopilot versions prior to 1.17.0-rc2 **Description** PX4 autopilot is a flight control solution for drones. A path traversal issue exists in the PX4 Autopilot MAVLink FTP implementation that allows any MAVLink peer to perform unauthorized file operations – including reading, writing, creating, deleting, and renaming – on the flight controller filesystem without authentication. On NuttX systems, the FTP root directory is empty, leading to direct passing of attacker-supplied paths to filesystem calls without any sanitization during read operations. On POSIX systems, the write-path validation function does not provide any protection. A time-of-check to time-of-use (TOCTOU) race condition in the write validation on NuttX systems further bypasses existing security measures. **Recommendations** Versions prior to 1.17.0-rc2 should be updated to version 1.17.0-rc2 or later.

**Name of the Vulnerable Software and Affected Versions** GetSimple CMS versions 3.3.22 massiveAdmin plugin version 6.0.3 **Description** GetSimple CMS, when used with the massiveAdmin plugin version 6.0.3, allows an authenticated administrator to overwrite the `gsconfig.php` configuration file with arbitrary PHP code through the gsconfig editor module. The form lacks Cross-Site Request Forgery (CSRF) protection, enabling a remote unauthenticated attacker to exploit this through CSRF against a logged-in administrator, potentially leading to Remote Code Execution (RCE) on the web server. This can be triggered by a malicious email containing an embedded form, resulting in a full server compromise. **Recommendations** For GetSimple CMS version 3.3.22 and massiveAdmin plugin version 6.0.3, ensure proper CSRF protection is implemented for the gsconfig editor module to prevent unauthorized modification of the `gsconfig.php` file.

**Name of the Vulnerable Software and Affected Versions** Homarr versions prior to 1.54.0 **Description** The integration.all tRPC endpoint in Homarr is accessible to unauthenticated users, potentially exposing a list of configured integrations. This exposed metadata includes sensitive information such as internal service URLs, integration names, and service types. The issue was addressed in version 1.54.0. **Recommendations** Update to version 1.54.0 or later.

**Nome do Software Vulnerável e Versões Afetadas** Versões do Statmatic anteriores à 5.73.11 Versões do Statmatic anteriores à 6.4.0 **Descrição** O Statmatic é um sistema de gerenciamento de conteúdo. Quando a manipulação de imagens Glide é usada em modo inseguro, um usuário não autenticado pode explorar o proxy de imagens para fazer o servidor enviar solicitações HTTP para URLs arbitrárias. Isso pode potencialmente permitir o acesso a serviços internos e endpoints de metadados de nuvem acessíveis a partir do servidor. **Recomendações** Atualize para a versão 5.73.11 ou posterior. Atualize para a versão 6.4.0 ou posterior.

**Name of the Vulnerable Software and Affected Versions** OneUptime versions prior to 10.0.7 **Description** OneUptime is a solution for monitoring and managing online services. A critical OS command injection vulnerability exists in the `NetworkPathMonitor.performTraceroute()` function. This flaw allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell metacharacters into a monitor's destination field. The vulnerability stems from the direct interpolation of the user-controlled `destination` parameter into a shell command string, which is then executed using `child process.exec()`. The `destination` parameter is not sanitized before being used in the command, allowing for the injection of malicious shell metacharacters such as semicolons, pipes, and subshells. Successful exploitation could lead to remote code execution, allowing attackers to read sensitive files, pivot to internal services, compromise monitoring data, and establish persistent backdoors. The vulnerability is present in the `Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts` file, specifically lines 149-191. **Recommendations** Upgrade to OneUptime version 10.0.7 or later to resolve this vulnerability. As a temporary workaround, audit monitor destinations for suspicious characters to prevent remote code execution.

**Nome do Software Vulnerável e Versões Afetadas** Versões do yt-dlp anteriores a 2026.02.21 **Descrição** A opção `--netrc-cmd` no yt-dlp apresenta uma vulnerabilidade de injeção de comando arbitrário. O argumento passado para o comando nesta opção está agora limitado a um subconjunto seguro de caracteres para corrigir isso. Essa vulnerabilidade poderia potencialmente permitir que um atacante executasse comandos arbitrários no sistema. **Recomendações** Atualize para a versão 2026.02.21 ou posterior do yt-dlp.

**Nome do Software Vulnerável e Versões Afetadas** Versões do Gogs anteriores à 0.14.2 **Descrição** O Gogs, um serviço Git autohospedado, contém uma vulnerabilidade de cross-site scripting (XSS) armazenado na funcionalidade de comentários e descrição de problemas. O sanitizador HTML permite esquemas URI `data:`, permitindo que usuários autenticados injetem execução arbitrária de JavaScript por meio de links maliciosos. A vulnerabilidade está localizada no arquivo `internal/markup/sanitizer.go`, onde o sanitizador HTML `bluemonday` está configurado para permitir URLs `data`. Tags de âncora HTML brutas contornam o parser Markdown e são processadas diretamente pelo sanitizador, permitindo que cargas úteis como `<a href="data:text/html...">` sejam renderizadas. A exploração envolve criar um arquivo com conteúdo HTML malicioso, fazer commit e push para um repositório, e em seguida clicar no link na interface web do Gogs. A exploração bem-sucedida permite que atacantes roubem cookies de autenticação, realizem ações em nome da vítima ou redirecionem usuários para sites maliciosos. **Recomendações** As versões anteriores à 0.14.2 devem ser atualizadas para a versão 0.14.2 ou superior.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.2.0 **Description** calibre is an e-book manager. A Server-Side Template Injection (SSTI) vulnerability exists in calibre’s Templite templating engine. This allows for arbitrary code execution when a user converts an ebook using a malicious custom template file via the `--template-html` or `--template-html-index` command-line options. Server-Side Template Injection (SSTI) is a flaw that allows an attacker to inject malicious code into a template engine, potentially leading to unauthorized access or control of the system. **Recommendations** Update to calibre version 9.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** calibre versions prior to 9.4.0 **Description** calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. The Content Server’s brute-force protection mechanism relies on a ban key derived from both the `remote addr` and the `X-Forwarded-For` header. The `X-Forwarded-For` header is directly read from HTTP requests without validation or trusted-proxy configuration. This allows attackers to bypass IP-based bans by modifying or adding to the `X-Forwarded-For` header, effectively disabling the brute-force protection. This poses a risk to servers exposed to the internet, as brute-force protection is a primary defense against credential stuffing and password guessing attacks. **Recommendations** Update to calibre version 9.4.0 or later.