Akos Jakab

**Name of the Vulnerable Software and Affected Versions** Ollama versions prior to 0.1.34 **Description** Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code execution (RCE). Exploitation involved overwriting `/etc/ld.so.preload` to load a malicious shared library, escalating from arbitrary file write to remote code execution. Over 1,000 instances were found to be exposed. The issue occurs because Ollama does not validate the format of the digest (SHA256 with 64 hexadecimal digits) when obtaining the model path, mishandling cases with fewer or more than 64 digits, or when the path begins with a `../` substring. **Recommendations** Versions prior to 0.1.34 should be updated to version 0.1.34 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Bit versions 2.0.7 through 3.0.3 **Description** A memory corruption vulnerability in Fluent Bit's embedded HTTP server allows an unauthenticated attacker to potentially execute arbitrary code, cause a denial of service, or disclose sensitive information. The issue is related to a heap buffer overflow when parsing trace requests. With over 13 billion downloads, Fluent Bit is widely used in major cloud platforms and by tech giants, making this vulnerability particularly concerning. While creating a reliable exploit for remote code execution may be challenging, a proof of concept for denial of service is already publicly available. **Recommendations** For Fluent Bit versions 2.0.7 through 3.0.3, upgrade to version 3.0.4 or later to mitigate the vulnerability. As a temporary workaround, consider restricting access to the API endpoint `/api/v1/traces endpoint` or disabling it altogether to prevent potential attacks. Limiting access to the vulnerable endpoint to authorized users and services can also help mitigate the issue until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Apache HugeGraph-Server versions 1.0.0 through 1.3.0 Description: The issue affects Apache HugeGraph-Server, allowing unauthenticated remote code execution and server takeover. This flaw can be exploited by attackers to bypass sandbox restrictions, leading to remote code execution. The vulnerability has been identified in HugeGraph-Server versions 1.0.0 – 1.3.0. It is recommended to upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. The vulnerability is being actively exploited, and users are advised to take immediate action to prevent exploitation. Recommendations: Upgrade to version 1.3.0 with Java11 and enable the Auth system to fix the issue. As a temporary workaround, consider disabling the vulnerable `groovy` injection functionality until a patch is available. Restrict access to the vulnerable `gremlin` endpoint to minimize the risk of exploitation. Avoid using the `groovy` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** XWiki Platform versions 2.4-milestone-1 through 4.10.20 XWiki Platform versions 15.5.4 and earlier XWiki Platform versions 15.10-rc-1 and earlier **Description** The issue in XWiki Platform stems from a lack of input validation within the database search functionality. This allows a non-authenticated attacker to achieve remote code execution. The database search is accessible by default to all users, meaning any visitor to a public wiki or user of a closed wiki could potentially exploit this issue, impacting the confidentiality, integrity, and availability of the entire XWiki installation. The vulnerability allows execution of arbitrary code through the search text. The API endpoint involved is `/xwiki/bin/get/Main/DatabaseSearch`. The vulnerable parameter is `text`. **Recommendations** XWiki Platform versions 2.4-milestone-1 through 4.10.20: Manually apply the patch to the `Main.DatabaseSearch` page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.5.4 and earlier: Manually apply the patch to the `Main.DatabaseSearch` page, or delete the page if database search is not explicitly used by users. XWiki Platform versions 15.10-rc-1 and earlier: Manually apply the patch to the `Main.DatabaseSearch` page, or delete the page if database search is not explicitly used by users.

**Name of the Vulnerable Software and Affected Versions** Gogs versions 0.13.0 and earlier **Description** The built-in SSH server of Gogs allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious `--split-string` env request if the built-in SSH server is activated. Approximately 7,300 exposed instances are affected, with 60% located in China. Users are urged to disable SSH and registration to minimize the risk. **Recommendations** For Gogs versions 0.13.0 and earlier, upgrade to version 0.13.1 or the latest 0.14.0+dev to resolve the issue. As a temporary workaround, consider disabling the built-in SSH server on operating systems other than Windows. Restrict access to the internal SSH server to minimize the risk of exploitation. Avoid using the `--split-string` env request in the affected SSH connection until the issue is resolved.