Mith36

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.3 Description Glances, a system cross-platform monitoring tool, allows for the execution of arbitrary system commands through dynamic configuration values. Specifically, substrings enclosed in backticks within configuration files are executed without validation using the `system exec()` function. This occurs during configuration parsing in `Config.get value()`. If an attacker can modify or influence these configuration files, they can execute commands with the privileges of the Glances process. This is particularly dangerous if Glances is running with elevated privileges, potentially leading to privilege escalation. The vulnerable files include `glances/config.py` and `glances/globals.py`. A proof of concept demonstrates arbitrary command execution by creating a malicious configuration file containing a command within backticks and launching Glances with this configuration. Recommendations Update Glances to version 4.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** SiYuan, a personal knowledge management system, has an unauthenticated arbitrary file read issue due to a path traversal flaw. The kernel exposes a file-serving endpoint at `/appearance/*filepath` that bypasses authentication checks. Improper path sanitization allows attackers to construct malicious requests to read arbitrary files accessible to the server process. The vulnerable code is located in `kernel/server/serve.go`, where the path is constructed by joining a base directory with user-controlled URL segments without proper validation. This allows the use of directory traversal sequences like `../` to escape the intended directory and access sensitive files. Exploitation can be achieved by sending a crafted GET request to the `/appearance/*filepath` endpoint, such as `GET /appearance/../../data/conf.json HTTP/1.1`. This could lead to the disclosure of workspace configuration files, user notes, API tokens, and potentially local system files, depending on permissions. An estimated number of potentially affected devices worldwide is not provided. **Recommendations** Update SiYuan to version 3.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 8.6.56 Parse Server versions prior to 9.6.0-alpha.45 **Description** Parse Server’s LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This affects deployments where the LiveQuery WebSocket endpoint is reachable by untrusted clients. **Recommendations** Upgrade to Parse Server version 8.6.56 or later. Upgrade to Parse Server version 9.6.0-alpha.45 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.6.2 **Description** SiYuan is a personal knowledge management system. The kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on attacker-controlled JSON. A remote attacker can send malformed messages that trigger a runtime panic, potentially crashing the kernel process and causing denial of service. The issue resides in the kernel/server/serve.go file, specifically in the handling of the `/ws?app=siyuan` endpoint with the `id=auth&type=auth` query parameters. The vulnerable code accesses fields from the incoming JSON data using type assertions without validation, such as `request["cmd"].(string)`, `request["reqId"].(float64)`, and `request["param"].(map[string]interface{})`. Malformed or missing fields can trigger a runtime panic, leading to a denial of service. **Recommendations** Versions prior to 3.6.2 should be updated to version 3.6.2 or later.