Thomasrinsma

**Name of the Vulnerable Software and Affected Versions** Feathersjs versions 5.0.39 and below **Description** Feathersjs is a framework used for building web APIs and real-time applications. A flaw exists where the redirect query parameter is added to the base origin without proper validation. This allows attackers to steal access tokens through URL authority injection, potentially leading to full account takeover. The application builds the redirect URL by combining the base origin with a user-provided redirect parameter. This is exploitable when origins do not end with a forward slash (/). An attacker can provide a malicious redirect value, such as `@attacker.com`, resulting in a URL like `https://target.com@attacker.com#access token=...`. The browser then interprets `attacker.com` as the host, enabling the attacker to obtain the victim's access token and impersonate them. **Recommendations** Update to version 5.0.40 or later.

**Name of the Vulnerable Software and Affected Versions** Feathersjs versions 5.0.39 and below **Description** Feathersjs is a framework used for building web APIs and real-time applications. A flaw in origin validation, specifically using the `startsWith()` function for comparison, allows attackers to bypass origin checks. This bypass is possible by registering a domain that shares a common prefix with an allowed origin. The `getAllowedOrigin()` function inadequately validates the prefix of the Referer header against allowed origins. An attacker can initiate the OAuth flow from an unauthorized origin and potentially steal tokens, leading to full account takeover. **Recommendations** Update to version 5.0.40 or later.

**Name of the Vulnerable Software and Affected Versions** Feathersjs versions 5.0.39 and below **Description** Feathersjs is a framework used for building web APIs and real-time applications. Versions 5.0.39 and below store all HTTP request headers in a session cookie that is signed but not encrypted. This can expose internal proxy/gateway headers to clients. The OAuth service stores the complete headers object in the session, which is then persisted using cookie-session and base64-encoded. While the cookie is signed, the data is readable by decoding the base64 value. In certain deployment configurations, such as those behind reverse proxies or API gateways, this can lead to the disclosure of sensitive internal infrastructure details like API keys, service tokens, and internal IP addresses. The issue involves the storage of sensitive information in the session cookie, specifically impacting the handling of HTTP request headers and OAuth service data. **Recommendations** Update to version 5.0.40 or later.

**Name of the Vulnerable Software and Affected Versions** Stalwart versions 0.13.3 and below **Description** Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory, potentially triggering the system's out-of-memory (OOM) killer and causing a denial of service. The `CommandParser` implementation generally limits the size of its dynamic buffer during parsing, but some state handlers do not perform these validation checks. **Recommendations** Update to version 0.13.4 or later. Implement rate limiting and connection monitoring at the network level as a workaround.

**Nome do software vulnerável e versões afetadas** Versões do react-pdf anteriores à 7.7.3 Versões do react-pdf anteriores à 8.0.2 **Descrição** O problema ocorre quando o PDF.js é usado para carregar um PDF malicioso e o PDF.js está configurado com `isEvalSupported` definido como `true`, que é o valor padrão. Essa configuração permite que JavaScript controlado por invasores seja executado sem restrições no contexto do domínio de hospedagem. **Recomendações** Para versões anteriores à 7.7.3, atualize para a versão 7.7.3 ou posterior. Para versões anteriores à 8.0.2, atualize para a versão 8.0.2 ou posterior. Como solução alternativa temporária, considere definir a opção `isEvalSupported` como `false` para minimizar o risco de exploração. Defina `options.isEvalSupported` como `false`, onde `options` é a propriedade do componente `Document`.

**Name of the Vulnerable Software and Affected Versions** Sails versions prior to 1.5.7 **Description** Sails is a realtime MVC Framework for Node.js. An attacker can send a virtual request that will cause the node process to crash. **Recommendations** For versions prior to 1.5.7, update to version 1.5.7 to resolve the issue. As a temporary workaround, consider disabling the sockets hook and removing the `sails.io.js` client until the update is applied.