Jorge Rosillo

**Name of the Vulnerable Software and Affected Versions** gotortc versions 1.8.5 and prior **Description** gotortc is a camera streaming application. The index page (`index.html`) shows available streams by fetching the API on the client side, using `Object.entries` to iterate over the result, and appending the first item (`name`) using `innerHTML`. This leads to DOM-based cross-site scripting. When a victim visits the server, their browser executes the request against the go2rtc instance, and after the request, the browser is redirected to go2rtc, where the XSS is executed in the context of go2rtc's origin. **Recommendations** As a temporary workaround, consider disabling the use of `innerHTML` for appending user-supplied data until a patch is available. Restrict access to the `index.html` page to minimize the risk of exploitation. Avoid using the `name` variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** gotortc versions 1.8.5 and prior **Description** The issue concerns a camera streaming application. It allows modification of the existing configuration with user-supplied values through the `/api/config` endpoint. Although this API only allows localhost to interact without authentication, it is not protected against Cross-Site Request Forgery (CSRF), enabling requests from any origin. This could lead to arbitrary command execution if an attacker adds a custom stream through `api/config`, utilizing the `exec` handler. When a victim visits the server, their browser will execute the requests against the go2rtc instance. **Recommendations** For versions 1.8.5 and prior, consider disabling the `exec` handler and restricting access to the `/api/config` endpoint to prevent arbitrary command execution until a patch is available. Additionally, ensure that go2rtc is set up securely on the upstream application to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** gotortc versions 1.8.5 and prior **Description** The issue is related to DOM-based cross-site scripting. The links page (`links.html`) appends the `src` GET parameter (`[0]`) in all of its links for 1-click previews. The context in which `src` is being appended is `innerHTML` (`[1]`), which will insert the text as HTML. **Recommendations** For versions 1.8.5 and prior, apply the patch from commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba to resolve the issue. As a temporary workaround, consider restricting the use of the `links.html` page or disabling the 1-click preview feature until the patch is applied. Avoid using the `src` parameter in the affected links until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Submarine versions 0.7.0 through 0.7.x **Description** The issue is caused by a bug in the serialization against YAML, specifically due to the use of snakeyaml. Apache Submarine uses JAXRS to define REST endpoints and handles YAML requests through a YamlEntityProvider entity provider. The readFrom method in YamlUtils.java processes incoming YAML requests, which can lead to the issue. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** For Apache Submarine versions 0.7.0 through 0.7.x, upgrade to version 0.8.0 to fix the issue. As a temporary workaround for versions smaller than 0.8.0, consider cherry-picking PR and rebuilding the submarine-server image to fix this.

**Name of the Vulnerable Software and Affected Versions** Common Voice version 1.88.2 **Description** The issue is related to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin, given that user-controlled data flows to a path expression. This may lead to reflected Cross-Site Scripting (XSS) attacks. The platform is used for collecting speech donations to create public domain datasets for training voice recognition-related tools. **Recommendations** For version 1.88.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OneSignal (affected versions not specified) **Description** The issue concerns a workflow triggered by closed issues, utilizing a GitHub repository token with full write permissions. This allows an attacker to potentially take over the GitHub Runner, run custom commands, steal secrets, or alter the repository. The vulnerability was discovered using CodeQL and involves javascript's Expression injection in Actions query. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cocos Engine (affected versions not specified) **Description** The issue concerns a command injection vulnerability in the `web-interface-check.yml` file of the Cocos Engine GitHub repository. This file was triggered by pull requests and contained a user-controllable field `github.head ref`, which is the name of the fork's branch. An attacker could exploit this to take over the GitHub Runner, run custom commands, and potentially steal secrets like `GITHUB TOKEN`, as well as alter the repository. The vulnerable workflow has been removed from the repository. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nepxion Discovery (affected versions not specified) **Description** The issue is related to SpEL Injection in discovery-commons, where the DiscoveryExpressionResolver’s eval method evaluates expressions with a StandardEvaluationContext. This allows the expression to interact with Java classes, such as java.lang.Runtime, leading to Remote Code Execution. There are no known workarounds for this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nepxion Discovery (affected versions not specified) **Description** The issue is related to a potential Server-Side Request Forgery (SSRF) in Nepxion Discovery, a solution for Spring Cloud. Specifically, the `RouterResourceImpl` uses `RestTemplate`'s `getForEntity` to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There are no known workarounds or patches available for this issue at the time of publication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.