Yaniv Nizry

**Name of the Vulnerable Software and Affected Versions** Memos version 0.22 **Description** When configured to store objects locally, the software allows an attacker to create a file via the `CreateResource` endpoint. This is achieved by including a path traversal sequence in the file name, enabling arbitrary file write on the server. **Recommendations** As a temporary workaround, restrict access to the `CreateResource` endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Memos version 0.22 **Description** Memos version 0.22 is susceptible to Stored Cross-Site Scripting (XSS) through the upload attachment and user avatar features. The software does not validate the content type of uploaded data before serving it, potentially allowing an authenticated attacker to elevate privileges when the stored XSS is viewed by an administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DevDojo Voyager versions 1.8.0 and earlier **Description** The issue allows an attacker to gain access to sensitive information through path traversal at the "/admin/compass" API endpoint. This vulnerability is related to errors in handling relative paths to directories, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For DevDojo Voyager versions 1.8.0 and earlier, consider restricting access to the "/admin/compass" endpoint until a patch is available. As a temporary workaround, limit the exposure of sensitive information that could be accessed through this endpoint.

**Name of the Vulnerable Software and Affected Versions** DevDojo Voyager versions 1.8.0 and earlier **Description** The issue allows for reflected XSS via the "/admin/compass" API endpoint. By manipulating an authenticated user to click on a link, arbitrary JavaScript code can be executed. **Recommendations** DevDojo Voyager versions 1.8.0 and earlier: Update to a version later than 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/admin/compass" API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** DevDojo Voyager versions 1.8.0 and earlier **Description** The issue allows an authenticated user to bypass file type verification when uploading a file via the "/admin/media/upload" endpoint. This can lead to the upload of a web shell, resulting in arbitrary code execution on the server. The vulnerability is being actively exploited. **Recommendations** For DevDojo Voyager versions 1.8.0 and earlier, as a temporary workaround, consider disabling the file upload functionality via the "/admin/media/upload" endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** binux pyspider versions up to 0.3.10 **Description** The issue is a Cross-Site Request Forgery (CSRF) that affects the Flask endpoints. This allows for unauthorized requests to be made on behalf of the user. **Recommendations** For versions up to 0.3.10, as a temporary workaround, consider restricting access to the Flask endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pyspider versions 0.3.10 and earlier **Description** The issue allows for Cross Site Scripting (XSS) via the `/update` endpoint. This affects products that are no longer supported by the maintainer. **Recommendations** For versions 0.3.10 and earlier, as a temporary workaround, consider disabling the `/update` endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins versions 2.217 through 2.441 Jenkins LTS versions 2.222.1 through 2.426.2 **Description** The issue is related to the built-in command line interface (CLI) of the Jenkins server, which has a weakness in its authentication procedure. This weakness can be exploited by a remote attacker to perform a cross-site WebSocket hijacking (CSWSH) attack, allowing the execution of CLI commands on the Jenkins controller. The vulnerability is due to the lack of origin validation of requests made through the CLI WebSocket endpoint. **Recommendations** For Jenkins versions 2.217 through 2.441, update to a version that includes the fix for this issue. For Jenkins LTS versions 2.222.1 through 2.426.2, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the CLI WebSocket endpoint until a patch is available. Restrict access to the Jenkins controller to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** typo3/html-sanitizer versions prior to 1.5.3 typo3/html-sanitizer versions prior to 2.1.4 **Description** The issue arises from incorrect handling of DOM processing instructions, allowing bypassing of the cross-site scripting mechanism of typo3/html-sanitizer. **Recommendations** For versions prior to 1.5.3, update to version 1.5.3 to resolve the issue. For versions prior to 2.1.4, update to version 2.1.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue involves the need for stronger revision number limitations on file serving endpoints to enhance cache poisoning protection. This is a measure to improve security against potential cache poisoning attacks, which could compromise the integrity of cached data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TYPO3 HTML Sanitizer versions 1.0.0 through 1.5.1 TYPO3 HTML Sanitizer versions 1.0.0 through 2.1.2 **Description** The issue arises from an encoding problem in the serialization layer of TYPO3 HTML Sanitizer, allowing malicious markup nested in a `noscript` element to bypass the cross-site scripting mechanism. The `noscript` element is disabled by default but may be enabled in custom configurations. This enables the bypassing of the cross-site scripting protection provided by TYPO3 HTML Sanitizer. **Recommendations** Update to version 1.5.1 or 2.1.2 to fix the issue. As a temporary workaround, consider disabling the `noscript` element in custom configurations until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 4.1.x through 4.1.2 Moodle versions 4.2.x through 4.1.9 is not correct, the correct is: Moodle versions 4.2.x before 4.2.0 **Description** The issue exists because the application allows a user to control the path of the folder to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. This can lead to unauthenticated arbitrary folder creation, and potentially to remote code execution (RCE). **Recommendations** For Moodle versions 4.1.x through 4.1.2, update to version 4.1.3 or later. For Moodle versions 4.2.x before 4.2.0, update to version 4.2.0 or later. As a temporary workaround, consider disabling the TinyMCE loaders until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** inikulin replicator versions prior to 1.0.4 **Description** A deserialization issue in the inikulin replicator allows remote attackers to run arbitrary code via the `fromSerializable` function in the `TypedArray` object. **Recommendations** For versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the `fromSerializable` function in the `TypedArray` object until a patch is available.

**Name of the Vulnerable Software and Affected Versions** URI.js versions prior to 1.19.6 **Description** The issue concerns the mishandling of backslash characters in certain URI schemes, such as `http:/`, which can lead to incorrect interpretation of the URI as a relative path. This can result in hostname spoofing when using affected versions to determine a URL's hostname. Impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior, depending on library usage and attacker intent. For example, a URL like `https:/expected-example.com/path` can be used to bypass security decisions. **Recommendations** For versions prior to 1.19.6, update to version 1.19.6 or later to resolve the issue. As a temporary workaround, consider validating URLs to prevent the use of backslash characters in scheme delimiters. Restrict access to URLs that may be interpreted as relative paths to minimize the risk of exploitation. Avoid using the backslash character in URI schemes until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Bleach versions prior to 3.3.0 **Description** A mutation XSS affects users calling `bleach.clean` with specific allowed tags and the keyword argument `strip comments=False`. This issue may allow a remote attacker to impact the confidentiality and integrity of protected information. The affected tags include `svg`, `math`, `p`, `br`, `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp`. Note that none of these tags are in the default allowed tags and `strip comments` defaults to `True`. **Recommendations** To resolve the issue, users are encouraged to upgrade to Bleach version 3.3.0 or greater. As a temporary workaround, modify `bleach.clean` calls to at least one of: * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag * not allow `svg` or `math` tags * not allow `p` or `br` tags * set `strip comments=True` Additionally, a strong Content-Security-Policy without `unsafe-inline` and `unsafe-eval` `script-src`s will also help mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Jupyter Server versions prior to 1.1.1 **Description** The issue is an open redirect vulnerability that could cause the Jupyter server to redirect the browser to a different malicious website. All Jupyter servers running without a base url prefix are technically affected. However, these maliciously crafted links can only be reasonably made for known Jupyter server hosts. A link to a Jupyter server may appear safe but ultimately redirect to a spoofed server on the public internet. **Recommendations** For versions prior to 1.1.1, upgrade to version 1.1.1 to resolve the issue. As a temporary workaround, consider running the server on a URL prefix by using the command `jupyter server --ServerApp.base url=/jupyter/`.

**Name of the Vulnerable Software and Affected Versions** python-lxml (affected versions not specified) **Description** A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Bleach versions prior to 3.12 **Description** A mutation XSS issue affects users calling `bleach.clean` with specific settings, including whitelisting `svg` or `math` tags, allowing RCDATA tags, and setting the `strip` keyword argument to `False`. This could potentially allow a remote attacker to impact data integrity. **Recommendations** For versions prior to 3.1.2: Upgrade to bleach v3.1.2 or greater. As a temporary workaround, consider modifying `bleach.clean` calls to use `strip=True`, or not whitelisting `math` or `svg` tags and one or more of the following tags: `script`, `noscript`, `style`, `noframes`, `xmp`, `noembed`, `iframe`. Implementing a strong Content-Security-Policy without `unsafe-inline` and `unsafe-eval` `script-src`s will also help mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Mozilla Bleach versions prior to 3.11 **Description** The issue exists due to inadequate protection of web page structure. Exploitation can allow a remote attacker to conduct a cross-site scripting (XSS) attack. A mutation XSS affects users calling `bleach.clean` with `noscript` and a raw tag in the allowed/whitelisted tags option. **Recommendations** For versions prior to 3.11, modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags: `title`, `textarea`, `script`, `style`, `noembed`, `noframes`, `iframe`, `xmp`. Implement a strong Content-Security-Policy without `unsafe-inline` and `unsafe-eval` `script-src`s to help mitigate the risk. Update to version 3.1.1 or later to resolve the issue.