Wolfgang Hotwagner

**Name of the Vulnerable Software and Affected Versions** decidim awesome-module versions 0.9.0 through 0.11.1 **Description** An improper neutralization of special elements used in an SQL command in the papertrail/version-model of the decidim awesome-module allows an authenticated admin user to manipulate SQL queries to disclose information, read and write files, or execute commands. This issue can lead to remote code execution on the server. The affected component is a raw SQL statement that uses an interpolated variable in the admin role actions method of the papertrail/version-model. An attacker with admin permissions could exploit this to read out the database, read files from the filesystem, write files to the filesystem, or execute commands. **Recommendations** For decidim awesome-module versions 0.9.0 through 0.11.1, consider disabling the `papertrail/version-model` until a patch is available to prevent manipulation of SQL queries. Restrict access to the admin role actions method in the app/models/decidim/decidim awesome/paper trail version.rb file to minimize the risk of exploitation. Avoid using interpolated variables in SQL statements to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FIWARE Keyrock versions <= 8.4 **Description** The issue is related to insufficiently random values for generating password reset tokens, allowing attackers to take over the account of any user by predicting the token for the password reset link. This enables attackers to potentially gain unauthorized access to user accounts. **Recommendations** For FIWARE Keyrock versions <= 8.4, update to a version that includes a fix for the insufficiently random password reset token generation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FIWARE Keyrock versions <= 8.4 **Description** The issue is related to insufficiently random values used for generating password reset tokens, allowing attackers to predict the token and disable two-factor authorization for any user. This makes it easier for attackers to guess tokens and take over accounts. **Recommendations** For FIWARE Keyrock versions <= 8.4, patch immediately to address the issue. Additionally, monitor for suspicious password resets as a precautionary measure.

**Name of the Vulnerable Software and Affected Versions** FIWARE Keyrock versions <= 8.4 **Description** The issue is related to insufficiently random values used for generating activation tokens. This allows attackers to predict the token for the activation link, enabling them to activate accounts of any user. **Recommendations** For FIWARE Keyrock versions <= 8.4, update to a version that includes a fix for this issue to prevent attackers from predicting activation tokens.

**Name of the Vulnerable Software and Affected Versions** FIWARE Keyrock versions <= 8.4 **Description** The function `generate app certificates` in lib/app certificates.js does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name. **Recommendations** For FIWARE Keyrock versions <= 8.4, as a temporary workaround, consider disabling the `generate app certificates` function until a patch is available. Restrict access to the lib/app certificates.js module to minimize the risk of exploitation. Avoid using the function `generate app certificates` to create applications with potentially malicious names until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FIWARE Keyrock versions <= 8.4 **Description** The function `generate app certificates` in controllers/saml2/saml2.js does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisation name. **Recommendations** For FIWARE Keyrock versions <= 8.4, as a temporary workaround, consider disabling the `generate app certificates` function until a patch is available. Restrict access to the saml2.js module to minimize the risk of exploitation. Avoid using malicious organisation names in application creation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: qcubed versions 3.1.1 and earlier Description: A reflected cross-site scripting (XSS) issue in profile.php via the `stQuery`-parameter allows unauthenticated attackers to steal sessions of authenticated users. Recommendations: For versions 3.1.1 and earlier, consider disabling access to the `profile.php` page until a patch is available, or restrict the use of the `stQuery` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Creative Contact Form extension versions 4.6.2 and earlier **Description** A directory traversal issue resides in the filename field for uploaded attachments via the `creativecontactform upload` parameter in the helpers/mailer.php file. This allows an attacker to exploit the vulnerability with the "Send me a copy" option to receive any files of the filesystem via email. **Recommendations** For Creative Contact Form extension versions 4.6.2 and earlier, update to a version released after 2019-12-03 to resolve the issue. As a temporary workaround, consider disabling the file upload functionality via the `creativecontactform upload` parameter until a patch is available. Restrict access to the "Send me a copy" option to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OkayCMS versions prior to 2.3.5 **Description** The issue allows an unauthenticated attacker to achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This can occur in two places: first in `view/ProductsView.php` using the cookie `price filter`, and second in `api/Comparison.php` via the cookie `comparison`. **Recommendations** For versions prior to 2.3.5, update to version 2.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `view/ProductsView.php` and `api/Comparison.php` files until a patch is available. Avoid using the cookies `price filter` and `comparison` in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** groonga-httpd version 6.1.5-1 **Description** The issue is related to the Debian packaging of the Groonga HTTP server, where the ownership of /var/log/groonga is set to the groonga account. This might allow local users to obtain root access due to unsafe interaction with logrotate. An example exploitation method involves a race condition to insert a symlink from /var/log/groonga/httpd to /etc/bash completion.d. **Recommendations** For groonga-httpd version 6.1.5-1, consider changing the ownership of /var/log/groonga to a more secure setting to prevent local users from obtaining root access. As a temporary workaround, restrict access to the logrotate configuration to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b Description: The issue is related to an improper neutralization of special elements used in a command, which can lead to command injection. This can result in the manipulation of gpg-keys or the execution of commands remotely. The attack is exploitable via the HKP-Api, specifically the endpoint "/pks/lookup?search". Recommendations: For PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b, consider disabling the `pgp exec()` function in phkp.php as a temporary workaround until a patch is available. Restrict access to the HKP-Api endpoint "/pks/lookup?search" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 5.0.32 Oracle VM VirtualBox versions prior to 5.1.14 **Description** The issue allows a high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products, and successful attacks can result in takeover of Oracle VM VirtualBox. **Recommendations** For versions prior to 5.0.32, update to version 5.0.32 or later. For versions prior to 5.1.14, update to version 5.1.14 or later.