Lujie

**Name of the Vulnerable Software and Affected Versions** luci-app-banip versions 0 through 0.11.1 **Description** A log parsing flaw exists where the `awk`-based parser extracts the first IPv4 address from log lines regardless of its field position. This allows an unauthenticated remote attacker to inject an arbitrary IP address through attacker-controlled fields, such as the login username field. Consequently, the system may block an incorrect target while the actual attacker remains unblocked. **Recommendations** Update luci-app-banip to a version later than 0.11.1.

**Name of the Vulnerable Software and Affected Versions** luci-app-tailscale-community (affected versions not specified) **Description** An issue in the `tailscale.do login` RPC method allows authenticated users to execute arbitrary commands with root privileges. This occurs because the `loginserver` and `loginserver authkey` parameters are improperly quoted within a double-quoted shell command, enabling shell substitutions such as `$()` to be evaluated by the outer shell before argument processing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenStack magnum yoga-eom version (affected versions not specified) **Description** An issue in the software allows a remote attacker to execute arbitrary code via the `cert manager.py` component. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.