Larry W. Cashdollar

**Name of the Vulnerable Software and Affected Versions** xaviershay-dm-rails gem version 0.10.3.8 **Description** The issue allows local users to discover MySQL credentials by listing a process and its arguments. This is due to a flaw in the `execute()` function in the `/datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb` file, which exposes sensitive information via the process table. A local attack may gain access to MySQL credential information. **Recommendations** For xaviershay-dm-rails gem version 0.10.3.8, consider disabling the `execute()` function in the `/datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb` file as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** php uploader (affected versions not specified) **Description** The issue is related to an arbitrary file upload vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files versions prior to 1.7.6 **Description** The WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities, due to its failure to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind a vulnerable website or to perform otherwise restricted actions. The attacker can subsequently download files with the extensions mp3, mp4a, wav, and ogg from anywhere the web server application has read access to the system. **Recommendations** For version 1.7.6, update to a newer version that contains a fix for this issue. For versions prior to 1.7.6, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle Solaris version 11 Description: The issue is related to inadequate access control in the Kernel component of Oracle Solaris, allowing a low-privileged attacker with logon access to the infrastructure to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. This can result in unauthorized update, insert, or delete access to some of Oracle Solaris' accessible data. Recommendations: For Oracle Solaris version 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Oracle Solaris version 11 Description: The issue is related to insufficient access control in the Kernel component of Oracle Solaris, which can be exploited to gain unauthorized access to sensitive information or cause a denial of service. The vulnerability can be easily exploited by a low-privileged attacker with logon access to the infrastructure where Oracle Solaris is executed, but it requires human interaction from a person other than the attacker. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data, as well as the ability to cause a partial denial of service. Recommendations: For Oracle Solaris version 11, apply the necessary patches or updates to fix the vulnerability in the Kernel component. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle Solaris version 11 **Description** The issue is related to insufficient input validation in the Device Driver Utility component of Oracle Solaris. This can be exploited to impact the confidentiality, integrity, and availability of protected information. The vulnerability is easily exploitable and can be compromised by a low-privileged attacker with logon to the infrastructure where Oracle Solaris is executed. Successful attacks require human interaction from a person other than the attacker and can result in the takeover of Oracle Solaris. **Recommendations** For Oracle Solaris version 11, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Device Driver Utility component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** phpzag live add edit delete data tables records with ajax php mysql (affected versions not specified) **Description** The issue is related to a lack of protection against SQL query structure exploitation, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability involves SQL injection with the `search` parameter in Records.php. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpzag live add edit delete data tables records with ajax php mysql (affected versions not specified) **Description** The issue is related to a lack of protection against SQL query structure exploitation, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability involves SQL injection with `start` and `length` parameters in Records.php. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpzag live add edit delete data tables records with ajax php mysql (affected versions not specified) **Description** The issue is related to SQL injection in the order and column parameters in Records.php. This is due to a lack of protection measures for the SQL query structure in the DataTables library. Exploitation of this issue could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: DeleGate version 9.9.13 Description: The issue allows local users to gain privileges, as demonstrated by the dgcpnod setuid program. Recommendations: For DeleGate version 9.9.13, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Features version 0.3.0 **Description** The issue allows remote attackers to inject malicious html in the "/tmp" directory. **Recommendations** For version 0.3.0, consider restricting access to the `/tmp` directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** upload-image-with-ajax version 1.0 **Description** A logic error in the code allows arbitrary files to be uploaded to the web root, enabling code execution. **Recommendations** For upload-image-with-ajax version 1.0, consider disabling the file upload functionality until a patch is available to prevent arbitrary file uploads and potential code execution.

**Name of the Vulnerable Software and Affected Versions** Online Store System version 1.0 **Description** The issue concerns the delete product.php file in the Online Store System, which fails to verify if a user is authenticated or has administrative rights. This oversight allows for arbitrary product deletion. **Recommendations** For Online Store System version 1.0, consider implementing authentication checks and verifying administrative rights in the delete product.php file to prevent unauthorized product deletion. As a temporary workaround, restrict access to the delete product.php file until a proper fix is implemented.

**Name of the Vulnerable Software and Affected Versions** Online Store version 1.0 **Description** The issue allows the registration form requirements for the member email format to be bypassed by posting directly to the "sent register.php" endpoint, enabling special characters to be included and an XSS payload to be injected. **Recommendations** For version 1.0, consider validating and sanitizing user input in the registration form to prevent the inclusion of special characters and XSS payloads. As a temporary workaround, restrict access to the "sent register.php" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Online Store version 1.0 **Description** The issue concerns a stored XSS in the admin/user view.php file, specifically affecting the `adidas member email` variable. **Recommendations** For Online Store version 1.0, consider restricting access to the admin/user view.php file until a patch is available, and avoid using the `adidas member email` variable in this context to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mambo CMS version 4.6.5 **Description** A vulnerability in the scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php discloses the root path of the webserver. **Recommendations** For Mambo CMS version 4.6.5, consider restricting access to the vulnerable scripts thumbs.php, editorFrame.php, editor.php, images.php, manager.php to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fileutils versions prior to 0.7.1 **Description** The issue concerns a Command Injection vulnerability. It occurs when a user-supplied `url` variable is passed to the shell, allowing for potential command injection. **Recommendations** For versions prior to 0.7.1, update to version 0.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of user-supplied `url` variables in the affected function until a patch is available. Avoid using the `url` variable in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** YingZhi Python Programming Language version 1.9 **Description** The issue allows for arbitrary anonymous uploads to the phone's storage. **Recommendations** For version 1.9, consider restricting access to the upload functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Easy2map-photos WordPress Plugin version 1.09 **Description** The issue allows SQL Injection due to unsanitized variables, including `mapTemplateName`, `mapName`, `mapSettingsXML`, `parentCSSXML`, `photoCSSXML`, `mapCSSXML`, `mapHTML`, and `mapID`. **Recommendations** For Easy2map-photos WordPress Plugin version 1.09, consider updating to a newer version that addresses this issue, if available. As a temporary workaround, restrict access to the plugin's functionality that utilizes these variables to minimize the risk of exploitation. Avoid using the variables `mapTemplateName`, `mapName`, `mapSettingsXML`, `parentCSSXML`, `photoCSSXML`, `mapCSSXML`, `mapHTML`, and `mapID` in sensitive operations until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Easy2map-photos WordPress Plugin version 1.09 **Description** The issue allows path traversal when specifying file names, enabling the creation of files outside of the upload directory. This is due to a vulnerability in the MapPinImageUpload.php and MapPinIconSave.php files. **Recommendations** For Easy2map-photos WordPress Plugin version 1.09, consider restricting access to the MapPinImageUpload.php and MapPinIconSave.php files until a patch is available. As a temporary workaround, avoid using the plugin's file upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.