Benoit Côté-Jodoin

**Name of the Vulnerable Software and Affected Versions** pdfkit versions 0.0.0 through 0.8.7.2 **Description** The issue is related to insufficient argument checking in the pdfkit library, which can be exploited by a remote attacker to execute arbitrary commands. This is a Command Injection vulnerability where the URL is not properly sanitized. **Recommendations** For pdfkit versions 0.0.0 through 0.8.7.2, update to a version later than 0.8.7.2, as the initial patch in 0.8.7.2 was found to be ineffective. As a temporary workaround, consider disabling the use of URLs in the pdfkit library until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `URL` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** devise-two-factor versions prior to 4.0.2 **Description** The issue allows reusing a One-Time-Password (OTP) for one immediately trailing interval due to an incomplete fix. **Recommendations** For versions prior to 4.0.2, update to version 4.0.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Action Pack versions 2.0.0 and later Action Pack versions prior to 5.2 with the provided patch Action Pack versions prior to 6.0 with the provided patch Action Pack versions prior to 6.1 with the provided patch **Description** The issue is related to a possible information disclosure or unintended method execution in Action Pack when using the `redirect to` or `polymorphic url` helper with untrusted user input. This could allow a remote attacker to access confidential data. Vulnerable code may look like `redirect to(params[:some param])`. **Recommendations** For Action Pack version 2.0.0 and later, upgrade to a fixed release or apply one of the provided patches. For Action Pack versions prior to 5.2, apply the 5-2-information-disclosure.patch. For Action Pack versions prior to 6.0, apply the 6-0-information-disclosure.patch. For Action Pack versions prior to 6.1, apply the 6-1-information-disclosure.patch. As a temporary workaround, consider using an allow list for valid parameters passed from the user, such as implementing a `check` function to validate user input before using it in `redirect to`. Alternatively, force the user input to be cast to a string, like `params[:some param].to s`, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Administrate (rubygem) versions prior to 0.13.0 **Description** The issue arises when sorting by attributes on a dashboard, where the `direction` parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. To exploit this, access to the Administrate dashboards is needed, which is typically expected to be behind authentication. **Recommendations** For versions prior to 0.13.0, update to version 0.13.0 to resolve the issue. As a temporary workaround, consider restricting access to the Administrate dashboards to minimize the risk of exploitation. Additionally, ensure that the `direction` parameter is properly validated before being used in SQL queries to prevent SQL injection attacks.

**Name of the Vulnerable Software and Affected Versions** esigate version 5.2 and earlier **Description** The issue concerns a problem with the neutralization of special elements in output used by a downstream component, which can lead to remote code execution. This is exploitable via the use of another weakness in the backend application to reflect ESI directives. **Recommendations** For esigate versions 5.2 and earlier, update to version 5.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 9.0.0.0 through 9.0.0.9 **Description** The issue allows a remote attacker to exploit the vulnerability to expose sensitive information or consume memory resources through a XML External Entity Injection (XXE) attack when processing XML data. **Recommendations** For IBM WebSphere Application Server versions 9.0.0.0 through 9.0.0.9, update to a version that is not affected by this issue to prevent XXE attacks.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 7.0 through 9.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is due to a lack of protection for the web page structure, which can be exploited by a remote attacker to inject arbitrary code into a loaded web page. **Recommendations** For versions 7.0 through 9.0, update to a version that includes the fix for this issue to prevent cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 7.0 through 9.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. **Recommendations** For IBM WebSphere Application Server versions 7.0 through 9.0, update the software to a version that does not use vulnerable SAML ear configurations to prevent cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 7.0 through 9.0 **Description** The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. This is achieved through cross-site scripting. **Recommendations** For IBM WebSphere Application Server versions 7.0 through 9.0, consider disabling the OAuth ear as a temporary workaround until a patch is available. Restrict access to the Web UI to minimize the risk of exploitation.