Mith36

Nome do Software Vulnerável e Versões Afetadas Glances versões anteriores a 4.5.3 Descrição Glances, uma ferramenta de monitoramento de sistema cross-platform, permite a execução de comandos arbitrários do sistema através de valores de configuração dinâmicos. Especificamente, substrings entre crases (backticks) dentro de arquivos de configuração são executados sem validação usando a função `system exec()`. Isso ocorre durante a análise da configuração em `Config.get value()`. Se um invasor puder modificar ou influenciar esses arquivos de configuração, ele poderá executar comandos com os privilégios do processo Glances. Isso é particularmente perigoso se o Glances estiver sendo executado com privilégios elevados, o que pode levar à escalada de privilégios. Os arquivos vulneráveis incluem `glances/config.py` e `glances/globals.py`. Uma prova de conceito demonstra a execução arbitrária de comandos criando um arquivo de configuração malicioso contendo um comando entre crases e executando o Glances com esta configuração. Recomendações Atualize o Glances para a versão 4.5.3 ou posterior.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** SiYuan, a personal knowledge management system, has an unauthenticated arbitrary file read issue due to a path traversal flaw. The kernel exposes a file-serving endpoint at `/appearance/*filepath` that bypasses authentication checks. Improper path sanitization allows attackers to construct malicious requests to read arbitrary files accessible to the server process. The vulnerable code is located in `kernel/server/serve.go`, where the path is constructed by joining a base directory with user-controlled URL segments without proper validation. This allows the use of directory traversal sequences like `../` to escape the intended directory and access sensitive files. Exploitation can be achieved by sending a crafted GET request to the `/appearance/*filepath` endpoint, such as `GET /appearance/../../data/conf.json HTTP/1.1`. This could lead to the disclosure of workspace configuration files, user notes, API tokens, and potentially local system files, depending on permissions. An estimated number of potentially affected devices worldwide is not provided. **Recommendations** Update SiYuan to version 3.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 8.6.56 Parse Server versions prior to 9.6.0-alpha.45 **Description** Parse Server’s LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This affects deployments where the LiveQuery WebSocket endpoint is reachable by untrusted clients. **Recommendations** Upgrade to Parse Server version 8.6.56 or later. Upgrade to Parse Server version 9.6.0-alpha.45 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** SiYuan is a personal knowledge management system. The kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON. A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service. The issue resides in the kernel/server/serve.go file, specifically in the handling of the `/ws?app=siyuan` endpoint with the `id=auth&type=auth` query parameters. The vulnerable code accesses fields from the incoming JSON data using type assertions without validation, such as `request["cmd"].(string)`, `request["reqId"].(float64)`, and `request["param"].(map[string]interface{})`. Malformed or missing fields can trigger a runtime panic, leading to a denial of service. **Recommendations** Versions prior to 3.6.2 should be updated to version 3.6.2 or later.