Robin Peraglie

**Name of the Vulnerable Software and Affected Versions** xfce4-settings versions 4.16.3 and earlier, 4.17.x before 4.17.1 **Description** There is an argument injection issue in the xfce4-mime-helper from the xfce4-settings package. This issue allows for argument injection, which can potentially be exploited. **Recommendations** For versions 4.16.3 and earlier, update to version 4.16.4 or later. For versions 4.17.x before 4.17.1, update to version 4.17.1 or later.

Name of the Vulnerable Software and Affected Versions: Open Container Initiative umoci versions prior to 0.4.7 Description: The issue allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used. This is due to improper input validation in umoci. The vulnerability can be exploited by creating a malicious layer with a symlink, which can trick umoci into modifying host files. This affects both "umoci unpack" and "umoci raw unpack" commands. Recommendations: For versions prior to 0.4.7, update to version 0.4.7 or later to resolve the issue. As a temporary workaround, consider running umoci under an LSM profile such as AppArmor or SELinux to restrict the level of access it has outside of container image directories. If using umoci as an unprivileged user with the --rootless flag, umoci will not be able to overwrite any files that the user doesn't have access to, which can serve as a mitigation.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A remote code execution risk was identified in the Shibboleth authentication plugin of Moodle. The issue is related to incorrect code generation management. An attacker can exploit this issue by sending a specially crafted request, allowing them to execute arbitrary code remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 8.3.0 through 8.7.26 TYPO3 versions 9.0.0 through 9.5.7 **Description** The issue allows for cross-site scripting (XSS), which is a type of attack where an attacker can inject malicious scripts into a website, potentially leading to unauthorized access or control. **Recommendations** For TYPO3 versions 8.3.0 through 8.7.26, update to a version outside of this range to mitigate the risk. For TYPO3 versions 9.0.0 through 9.5.7, update to a version outside of this range to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 8.x through 8.7.26 TYPO3 versions 9.x through 9.5.7 **Description** The issue allows Deserialization of Untrusted Data. **Recommendations** For versions 8.x through 8.7.26, update to a version outside of this range to resolve the issue. For versions 9.x through 9.5.7, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MyBB versions prior to 1.8.21 **Description** The issue is related to a parsing flaw in the Private Message / Post renderer, specifically a nested video MyCode issue, which can lead to persistent XSS. This allows an attacker to potentially take over any forum account. **Recommendations** For versions prior to 1.8.21, update to version 1.8.21 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MyBB versions prior to 1.8.21 **Description** The issue allows an attacker to create a PHP shell in the cache directory of a targeted forum via a crafted XML import. This is achieved by exploiting a default behavior of MySQL on many systems, where strings that are too long for a database column are truncated. For example, a string like `aaaaaaaaaaaaaaaaaaaaaa.php.css` can be truncated to `aaaaaaaaaaaaaaaaaaaaaa.php` due to a 30-character limit, leading to remote code execution. **Recommendations** For MyBB versions prior to 1.8.21, update to version 1.8.21 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey versions prior to 2.72.4 **Description** The issue concerns a Stored XSS that can be triggered by utilizing the Continue Later feature to input an email address. This email address is then mishandled within the admin panel, leading to potential exploitation. **Recommendations** For versions prior to 2.72.4, update to version 2.72.4 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.7.2.5 Description: The issue allows an attack in the orders section of PrestaShop after gaining access with a user role of at least a Salesman or higher privileges. The attacker can inject arbitrary PHP objects and abuse an object chain to gain Remote Code Execution. This occurs because protection against serialized objects looks for a `0:` followed by an integer, but does not consider `0:+` followed by an integer. Recommendations: For PrestaShop versions prior to 1.7.2.5, update to version 1.7.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the orders section to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** phpBB versions prior to 3.2.4 **Description** The issue allows for Remote Code Execution through Object Injection by utilizing Phar deserialization. This can be achieved by passing an absolute path to a file exists check. The exploitation of this issue requires access to the Admin Control Panel with founder permissions. **Recommendations** For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Admin Control Panel to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 3.x **Description** An issue was discovered that allows a Teacher creating a Calculated question to intentionally cause remote code execution on the server through eval injection. **Recommendations** For Moodle versions 3.x, update to a version that includes a fix for this issue to prevent remote code execution.

**Name of the Vulnerable Software and Affected Versions** Roundcube versions prior to 1.1.7 Roundcube versions 1.2.x prior to 1.2.3 **Description** The issue allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message. This is due to the improper restriction of custom envelope-from addresses on the sendmail command line when no SMTP server is configured and the sendmail program is enabled. **Recommendations** For Roundcube versions prior to 1.1.7, update to version 1.1.7 or later. For Roundcube versions 1.2.x prior to 1.2.3, update to version 1.2.3 or later.