Ssshah2131

**Name of the Vulnerable Software and Affected Versions** MobSF versions up to and including 4.3.2 **Description** MobSF is a mobile application security testing tool used by security teams across numerous organizations, typically deployed on centralized internal or cloud-based servers. The tool provides a feature that allows users to upload ZIP files for static analysis, which are automatically extracted and stored within the MobSF directory. However, this functionality lacks a check on the total uncompressed size of the ZIP file, making it vulnerable to a ZIP of Death (zip bomb) attack. An attacker can craft a specially prepared ZIP file that is small in compressed form but expands to a massive size upon extraction, exhausting the server's disk space and leading to a complete denial of service (DoS) not just for MobSF, but also for any other applications or websites hosted on the same server. This vulnerability can lead to complete server disruption in an organization, affecting other internal portals and tools too. **Recommendations** For versions up to and including 4.3.2, update to a version that includes the fix, such as the version after commit 6987a946485a795f4fd38cebdb4860b368a1995d. As an additional mitigation, implement a safeguard that checks the total uncompressed size of any uploaded ZIP file before extraction, rejecting files that exceed a safe threshold, such as 100 MB, and notify the user.

**Name of the Vulnerable Software and Affected Versions** Mobile Security Framework (MobSF) versions up to and including 4.3.2 **Description** A Stored Cross-Site Scripting (XSS) issue has been identified in MobSF. The issue arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. When an Android Studio project contains a malicious SVG file as an app icon and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG. The SVG file becomes publicly accessible via the web interface, and if it contains embedded JavaScript, accessing the URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS. **Recommendations** For versions up to and including 4.3.2, update to version 4.3.3 to fix the issue. As a temporary workaround, consider restricting access to the `download` endpoint, specifically to files with the `.svg` extension, to minimize the risk of exploitation. Avoid using the `http://127.0.0.1:8081/download/filename.svg` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Aimeos versions 2024.04 through 2024.07.1 **Description** The issue affects all SaaS and marketplace setups using the Aimeos GraphQL API admin interface, potentially allowing a denial of service attack. **Recommendations** For versions 2024.04 through 2024.07.1, update to version 2024.07.2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** aimeos/ai-controller-frontend versions prior to 2024.4.2 aimeos/ai-controller-frontend versions prior to 2023.10.9 aimeos/ai-controller-frontend versions prior to 2022.10.8 aimeos/ai-controller-frontend versions prior to 2021.10.8 aimeos/ai-controller-frontend versions prior to 2020.10.15 **Description** The issue is related to an insecure direct object reference, which allows an attacker to disable subscriptions and reviews of another customer. **Recommendations** For versions prior to 2024.4.2, update to version 2024.4.2 or later. For versions prior to 2023.10.9, update to version 2023.10.9 or later. For versions prior to 2022.10.8, update to version 2022.10.8 or later. For versions prior to 2021.10.8, update to version 2021.10.8 or later. For versions prior to 2020.10.15, update to version 2020.10.15 or later.

**Name of the Vulnerable Software and Affected Versions** aimeos/ai-admin-graphql versions 2022.04.01 through 2022.10.09 aimeos/ai-admin-graphql versions 2022.10.10 through 2023.10.05 aimeos/ai-admin-graphql versions 2023.10.06 through 2024.04.05 **Description** The issue is related to an improper access control vulnerability in the Aimeos GraphQL API admin interface, which allows an editor to modify and take over an admin account in the back end. **Recommendations** For versions 2022.04.01 through 2022.10.09, update to version 2022.10.10 or later. For versions 2022.10.10 through 2023.10.05, update to version 2023.10.06 or later. For versions 2023.10.06 through 2024.04.05, update to version 2024.04.6 or later.

**Name of the Vulnerable Software and Affected Versions** aimeos/ai-admin-jsonadm versions prior to 2020.10.13 aimeos/ai-admin-jsonadm versions prior to 2021.10.6 aimeos/ai-admin-jsonadm versions prior to 2022.10.3 aimeos/ai-admin-jsonadm versions prior to 2023.10.4 aimeos/ai-admin-jsonadm versions prior to 2024.4.2 **Description** The issue is related to improper access control in the Aimeos e-commerce JSON API for administrative tasks. This allows editors to remove admin group and locale configuration in the Aimeos backend. **Recommendations** For versions prior to 2020.10.13, update to version 2020.10.13 or later. For versions prior to 2021.10.6, update to version 2021.10.6 or later. For versions prior to 2022.10.3, update to version 2022.10.3 or later. For versions prior to 2023.10.4, update to version 2023.10.4 or later. For versions prior to 2024.4.2, update to version 2024.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** aimeos/ai-admin-graphql versions 2022.04.1 through 2022.10.9 aimeos/ai-admin-graphql versions 2022.10.10 through 2023.10.5 aimeos/ai-admin-graphql versions 2023.10.6 through 2024.4.1 **Description** The issue is related to improper access control in the Aimeos GraphQL API admin interface, allowing editors to manage their own services via the GraphQL API, which is not permitted in the JQAdm front end. **Recommendations** For versions 2022.04.1 through 2022.10.9, update to version 2022.10.10 or later. For versions 2022.10.10 through 2023.10.5, update to version 2023.10.6 or later. For versions 2023.10.6 through 2024.4.1, update to version 2024.4.2 or later.

**Name of the Vulnerable Software and Affected Versions** aimeos/ai-controller-frontend versions prior to 2024.04.2 aimeos/ai-controller-frontend versions prior to 2023.10.9 aimeos/ai-controller-frontend versions prior to 2022.10.8 aimeos/ai-controller-frontend versions prior to 2021.10.8 aimeos/ai-controller-frontend versions prior to 2020.10.15 **Description** The issue is related to the payment status of a user's basket not being reset after a purchase is completed. This could potentially allow for manipulation. **Recommendations** Update to version 2024.04.2 or later. Update to version 2023.10.9 or later. Update to version 2022.10.8 or later. Update to version 2021.10.8 or later. Update to version 2020.10.15 or later.

**Name of the Vulnerable Software and Affected Versions** ai-client-html versions prior to 2024.04.7 ai-client-html versions prior to 2023.10.15 ai-client-html versions prior to 2022.10.13 ai-client-html versions prior to 2021.10.22 **Description** The issue concerns debug information revealing sensitive information from environment variables in error logs. This affects Laravel environments with multi-vendor setups and admin access for the vendors. **Recommendations** For versions prior to 2024.04.7, update to version 2024.04.7 to resolve the issue. For versions prior to 2023.10.15, update to version 2023.10.15 to resolve the issue. For versions prior to 2022.10.13, update to version 2022.10.13 to resolve the issue. For versions prior to 2021.10.22, update to version 2021.10.22 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Aimeos versions 2024.01.1 through 2024.04.4 **Description** The issue allows a user with administrative privileges to upload files that appear to be images but actually contain PHP code, which can then be executed in the context of the web server. **Recommendations** For Aimeos versions 2024.01.1 through 2024.04.4, update to version 2024.04.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Aimeos HTML client versions 2020.04.1 through 2020.10.26 Aimeos HTML client versions prior to 2021.10.21 Aimeos HTML client versions prior to 2022.10.12 Aimeos HTML client versions prior to 2023.10.14 Aimeos HTML client versions prior to 2024.04.5 **Description** The issue allows digital downloads sold in online shops to be downloaded without valid payment, for example, if the payment did not succeed. **Recommendations** For versions 2020.04.1 through 2020.10.26, update to version 2020.10.27 or later. For versions prior to 2021.10.21, update to version 2021.10.21 or later. For versions prior to 2022.10.12, update to version 2022.10.12 or later. For versions prior to 2023.10.14, update to version 2023.10.14 or later. For versions prior to 2024.04.5, update to version 2024.04.5 or later.

**Name of the Vulnerable Software and Affected Versions** Aimeos versions 2022 through 2024 **Description** The issue affects all SaaS and marketplace setups, potentially leading to a denial of service attack. **Recommendations** Upgrade to version 2022.10.17 to receive a patch. Upgrade to version 2023.10.17 to receive a patch. Upgrade to version 2024.04 to receive a patch.