Tonghuaroot

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.1 **Description** An OS command injection issue exists in the `plugin/API/standAlone/functions.php` file. The `listFFmpegProcesses()` function interpolates unsanitized keyword parameters within single quotes without proper escaping. An attacker can provide a specially crafted encrypted `codeToExec` payload to break out of the single-quoted grep context, allowing the execution of arbitrary operating system commands with the privileges of the web-server user. **Recommendations** Update AVideo to a version later than 29.0. As a temporary mitigation, restrict access to the `listFFmpegProcesses()` function.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.0 **Description** An OS command injection issue exists in the 'ffmpeg.json.php' endpoint. The `notifyCode` and `callback` parameters are concatenated into a shell command without proper escaping. An attacker capable of crafting a valid encrypted payload can inject shell metacharacters into these fields to execute arbitrary operating system commands with the privileges of the web-server user. **Recommendations** Update to a version newer than 29.0. As a temporary mitigation, restrict access to the 'ffmpeg.json.php' endpoint or avoid using the `notifyCode` and `callback` parameters.

**Name of the Vulnerable Software and Affected Versions** BBOT (affected versions not specified) **Description** The unarchive module fails to detect symlinks in zip and 7z archives when the listing includes a DOS-attribute prefix before the unix mode, a characteristic of legacy p7zip versions. This allows an attacker to bypass security guards during a scan, such as through the `filedownload` process, resulting in an attacker-controlled symlink being written into the extraction directory. The impact is limited to the creation of the symlink, as the target is not written through. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ All versions prior to 5.19.8 Apache ActiveMQ All versions 6.0.0 through 6.2.6 Apache ActiveMQ Client versions prior to 5.19.8 Apache ActiveMQ Client versions 6.0.0 through 6.2.6 Apache ActiveMQ Broker versions prior to 5.19.8 Apache ActiveMQ Broker versions 6.0.0 through 6.2.6 **Description** An authenticated user can trigger a Denial of Service (DoS) by sending a specially crafted OpenWire Message containing an excessive encoded size value for the map. Because OpenWire message property maps are unmarshaled without proper size validation, this can lead to Out of Memory (OOM) conditions, causing the broker to crash. **Recommendations** Upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ All to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ Client to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ Broker to version 5.19.8 or 6.2.7.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ All versions prior to 5.19.8 Apache ActiveMQ All versions 6.0.0 through 6.2.6 Apache ActiveMQ Stomp versions prior to 5.19.8 Apache ActiveMQ Stomp versions 6.0.0 through 6.2.6 **Description** An unauthenticated client can exhaust the JVM heap by opening a STOMP NIO connection and sending header bytes that never terminate, causing the broker to buffer them without limit. **Recommendations** Upgrade Apache ActiveMQ to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ All to version 5.19.8 or 6.2.7. Upgrade Apache ActiveMQ Stomp to version 5.19.8 or 6.2.7.

**Name of the Vulnerable Software and Affected Versions** LXD versions prior to 6.9 LXD version 5.21 **Description** A nil-pointer dereference occurs in the `CreateCustomVolumeFromBackup()` function when processing a specially crafted custom-volume backup tarball that omits the `expires at` snapshot field. An authenticated user with `can create storage volumes` permissions can exploit this to cause a denial of service on Linux systems. A nil-pointer dereference is a runtime error that happens when a program attempts to use a pointer that does not point to any valid memory location. **Recommendations** Update LXD to a version later than 6.8. Update LXD to a version later than 5.21.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Certificates containing wildcard DNS Subject Alternative Names (SANs), such as `*.example.com`, bypass name-constraint checks performed by the Certificate Authority (CA). This allows a certificate to be accepted even if its wildcard DNS SAN should have been rejected based on the issuing CA's permitted or excluded DNS name constraints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (Meet plugin) versions prior to commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 **Description** A stored cross-site scripting issue exists in the Meet plugin's 'getMeetInfo.json.php' endpoint. The application stores the raw HTTP User-Agent header in the `meet join log.user agent` variable without sanitization, bypassing the `xss esc()` layer. This data is subsequently displayed in the Participants management panel without output encoding via `htmlspecialchars()`. An unauthenticated attacker can join a public meeting and provide a User-Agent header containing a malicious HTML or JavaScript payload. This payload is then executed within the authenticated session of a meeting host or site administrator when they view the participant list. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.39.0 **Description** An authentication bypass exists in the Budibase server route `POST /api/attachments/:datasourceId/url` because it lacks the `authorized(...)` middleware. An anonymous attacker who can enumerate a workspace ID (`app ...`) and an S3-source datasource ID (`ds ...`) can call this endpoint to obtain a 15-minute pre-signed PUT URL. This URL is minted using the victim's IAM identity, allowing the attacker to write arbitrary objects to any S3 bucket that the IAM credentials have permission to access, not just the bucket configured for the datasource. The endpoint also returns the `publicUrl`, confirming the destination of the uploaded file. The issue is further exacerbated by the `currentWorkspace` middleware, which fails to block non-browser clients (such as curl) from accessing development workspaces. **Recommendations** Update Budibase to version 3.39.0 or later. As a temporary mitigation, restrict access to the `POST /api/attachments/:datasourceId/url` endpoint to authorized users only.

**Name of the Vulnerable Software and Affected Versions** js-toml versions prior to 1.1.1 **Description** The software contains a quadratic time complexity issue during the parsing of hexadecimal, octal, and binary integer literals. This occurs because the `parseBigInt()` function uses a loop that performs a `BigInt * BigInt` operation for each input digit, resulting in O(n²) CPU consumption relative to the literal length. Since the lexer regex does not limit the length of these literals, an attacker can provide a specially crafted TOML document to cause CPU exhaustion, leading to a Denial of Service (DoS). This affects callers using the `load()` function on untrusted input, such as configuration upload endpoints or CI/CD systems. **Recommendations** Update to version 1.1.1.

**Name of the Vulnerable Software and Affected Versions** @microsoft/kiota-http-fetchlibrary versions 1.0.0-preview.97 through 1.0.0-preview.101 **Description** The `RedirectHandler` in the library fails to properly remove sensitive headers during cross-origin redirects. While it is intended to strip `Authorization` and `Cookie` headers, the default `scrubSensitiveHeaders` callback in `RedirectHandlerOptions` performs case-sensitive deletion. Because the `FetchRequestAdapter.getRequestFromRequestInformation` function has already converted headers to lowercase, the deletion attempts target non-existent keys. Consequently, the scrubbing process is ineffective, allowing Bearer tokens or Cookies to be forwarded to attacker-controlled hosts during a 30x redirect. This issue affects the default middleware chain (`MiddlewareFactory.getDefaultMiddlewares`) and any TypeScript SDK using `BaseBearerTokenAuthenticationProvider` or other providers that set the `Authorization` header. **Recommendations** Update to version 1.0.0-preview.102.

**Name of the Vulnerable Software and Affected Versions** undici versions 7.23.0 through 7.27.x undici versions 8.0.0 through 8.4.x **Description** The ProxyAgent in undici silently drops the `requestTls` option when configured with a SOCKS5 proxy URI (`socks5://` or `socks://`). This causes the target HTTPS connection through the SOCKS5 tunnel to fall back to the default Node.js trust store, ignoring user-defined settings such as `ca`, `cert`, `key`, `rejectUnauthorized`, and `servername`. Consequently, applications that rely on `requestTls.ca` to pin to an internal or corporate Certificate Authority (CA) will instead use the default Mozilla CA bundle. This allows any certificate signed by a publicly trusted CA for the target hostname to be accepted, enabling Man-in-the-Middle (MITM) attacks to read and tamper with the HTTPS exchange. **Recommendations** Upgrade to version 7.28.0. Upgrade to version 8.5.0. Route traffic through an HTTP-proxy ProxyAgent instead of a SOCKS5 proxy to ensure `requestTls` is honored correctly.

**Name of the Vulnerable Software and Affected Versions** @opentelemetry/core versions prior to 2.8.0 **Description** The `W3CBaggagePropagator.extract()` function in `@opentelemetry/core` fails to enforce size limits when parsing inbound `baggage` HTTP headers. While the W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries, these limits were only applied to the outbound `inject()` path. Consequently, parsing oversized baggage leads to memory allocation proportional to the header size. The risk is increased in deployments where transport-layer limits are absent, such as non-HTTP transports, custom `TextMapGetter` implementations, or environments where the Node.js `--max-http-header-size` has been increased. **Recommendations** Update to version 2.8.0 or later. Ensure header size limits are configured at the server or gateway level. For non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.

**Name of the Vulnerable Software and Affected Versions** node-tar versions prior to 7.5.16 **Description** An interpretation differential exists in how the software parses tar archives. The issue occurs because the library applies a PAX extended header's `size=` record (and other PAX overrides) to the next header entry regardless of its type. According to POSIX pax standards, a PAX extended header (`x`) should describe the next file entry, not intermediary extension headers such as GNU long-name (`L`) or long-link (`K`) entries. By allowing the PAX `size` to override the byte length of an intervening `L`, `K`, or `x` header, an attacker can desynchronize the stream cursor. This results in a discrepancy where a single crafted archive is interpreted differently by node-tar compared to other mainstream implementations like GNU tar, libarchive/bsdtar, and Python tarfile. This behavior can be exploited to hide archive members from security scanners that use one parser while the final extraction is performed by another, potentially bypassing malware or secret detection tools. **Recommendations** Update to version 7.5.16.

**Name of the Vulnerable Software and Affected Versions** AIOHTTP versions prior to 3.14.0 **Description** Attacker-controlled input included in multipart/payload headers can be used to modify a request to inject additional headers or change the request contents. This occurs when an application passes user-controlled strings into the `MultipartWriter.append(headers=...)` function or the `Payload.headers` variable. **Recommendations** Update to version 3.14.0. Sanitize user input passed into multipart/payload headers.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0597 **Description** Python omni-completion in the text editor executes reconstructed function and class definitions from the current buffer using the `exec()` function to populate the completion dictionary. Because Python evaluates class base expressions, parameter annotations, and function default values during definition, a malicious buffer can trigger the execution of attacker-controlled Python expressions during the omni-completion process. The `g:pythoncomplete allow import` mitigation is ineffective in this case as the executed code is not an import statement. **Recommendations** Update to version 9.2.0597.

**Name of the Vulnerable Software and Affected Versions** tmp version 0.2.6 **Description** A type-confusion issue exists in the ` assertPath` guard. The guard only rejects string values containing the substring `..`, allowing it to be bypassed when `prefix`, `postfix`, or `template` are supplied as non-string values (such as Array, Buffer, or other objects). If these values return falsy for `includes('..')` but contain `../` upon stringification, they flow through `Array.prototype.join` or string coercion within ` generateTmpName` and `path.join(tmpDir, opts.dir, name)`. This results in a path traversal that escapes the temporary directory, enabling the creation of files or directories at attacker-controlled locations with the privileges of the host process. This occurs in applications that forward untrusted request data into the functions `tmp.file()`, `tmp.fileSync()`, `tmp.dir()`, `tmp.dirSync()`, `tmp.tmpName()`, or `tmp.tmpNameSync()` without explicit type coercion. **Recommendations** Update to version 0.2.7. As a temporary workaround, implement explicit type coercion for the `prefix`, `postfix`, and `template` variables before passing them to the affected functions.

**Name of the Vulnerable Software and Affected Versions** Vim versions prior to 9.2.0561 **Description** The Python omni-completion script in `python3complete.vim` (for builds with the +python3 interpreter enabled) and `pythoncomplete.vim` (for builds with the +python interpreter) executes import and from statements found in the current buffer using Python's import machinery. Since the buffer's working directory is included in `sys.path`, opening a malicious .py file that has a sibling Python package and triggering omni-completion allows the top-level code of that package to be executed with the privileges of the user editing the file. **Recommendations** Update to version 9.2.0561.

**Name of the Vulnerable Software and Affected Versions** PhpWeasyPrint versions prior to 2.5.1 **Description** PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The software contains a shell command injection flaw occurring when the binary path for WeasyPrint is processed. The library passes the binary path through `escapeshellarg()` and then validates the quoted result using `is executable()`. On POSIX systems, this results in `is executable()` searching for a filename that literally includes the quotes, causing the security check to fail. Consequently, the raw `$binary` string, which can be set via the constructor or the `setBinary()` function, is passed directly into `SymfonyComponentProcessProcess::fromShellCommandline()`. This creates a risk of command injection if the binary path is sourced from environment variables, configuration files, or per-tenant settings. **Recommendations** Update to version 2.5.1.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 7.0.5 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.5 contain a flaw in the `disposeDocument()` method within the EtherFaxActions.php file. This allows authenticated users to write arbitrary content to arbitrary locations on the server filesystem, potentially leading to Remote Code Execution (RCE) through the upload of malicious PHP web shells. The vulnerable method allows for the writing of files to the server. **Recommendations** Update OpenEMR to version 7.0.5 or later.