Mscherer

**Name of the Vulnerable Software and Affected Versions** Woodpecker versions prior to 0.15.1 **Description** The issue allows cross-site scripting (XSS) via build logs because the `BuildLog.vue` component in `web/src/components/repo/build` lacks proper escaping. This can lead to the execution of malicious scripts. **Recommendations** For versions prior to 0.15.1, update to version 0.15.1 or later to resolve the issue. As a temporary workaround, consider restricting access to build logs until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Synapse versions prior to 1.28.0 **Description** The issue affects Synapse, a Matrix reference homeserver written in python, where requests to user-provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. This could cause Synapse to make requests to internal infrastructure on dual-stack networks, affecting outbound requests to federation, identity servers, key validity calculations for third-party invite events, push notifications, and URL previews. **Recommendations** For Synapse versions prior to 1.28.0, update to version 1.28.0 or later to resolve the issue. As a temporary workaround, consider blocking outbound requests to the following address ranges by a firewall, if unused for internal communication between systems: `::ffff/80`, `::0000/80`, and `2002::/16`.

**Name of the Vulnerable Software and Affected Versions** LinuxMint (affected versions not specified) **Description** The issue concerns temporary file creation vulnerabilities in the mintUpdate component of LinuxMint. As of 2012-03-19, LinuxMint is affected by this issue. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat OpenShift Origin versions prior to 1.0.5-3 **Description** The issue allows remote attackers to execute arbitrary commands via a crafted uuid in the `PATH INFO`. **Recommendations** For versions prior to 1.0.5-3, update to version 1.0.5-3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Red Hat OpenShift Origin versions prior to 1.0.5-3 **Description** The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH INFO. This can be exploited by including a malicious URL, potentially leading to phishing attacks. **Recommendations** For versions prior to 1.0.5-3, update to version 1.0.5-3 or later to resolve the issue.