CWE-345

Aplikacja Note Mark przed wersją 0.19.4 nie wymuszała minimalnej długości ani entropii wartości konfiguracyjnej JWT_SECRET, akceptując sekrety tak krótkie jak 1 bajt. Skutkuje to słabą kryptografią podpisywania tokenów JWT, co umożliwia ich fałszowanie.

Biblioteka cpp-httplib przed wersją 0.27.0 pozwala atakującemu na wstrzyknięcie spreparowanych nagłówków HTTP (REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT), które są traktowane jako wiarygodne metadane po stronie serwera. Podatność umożliwia spoofing adresu IP, zatrucie logów oraz obejście mechanizmów autoryzacji bez żadnego uwierzytelnienia.

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.

scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users registered to the specific instance and the ability to post in the name of the victim's social media channels added to that Postiz instance. This issue has been fixed in version 2.21.8.

Podatność w endpoincie upgrade_contents.php urządzeń DB Electronica Telecomunicazioni Mozart FM Transmitter pozwala nieuwierzytelnionemu atakującemu na przesłanie złośliwego pakietu firmware bez żadnej weryfikacji. Prowadzi to do zdalnego wykonania kodu (RCE) na podatnym urządzeniu.

HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.

Krytyczna podatność w aplikacji Boomplay firmy TECNO Mobile umożliwia obejście mechanizmu uwierzytelnienia bez jakichkolwiek uprawnień czy interakcji użytkownika. Ocena CVSS 9.8 wskazuje na bardzo wysokie ryzyko naruszenia poufności, integralności i dostępności danych.

Podatność w Mozilla Thunderbird i Firefox powodowała, że aplikacja ignorowała ścieżki URL podczas sprawdzania poprawności nawigacji w ramce (frame). Błąd otrzymał ocenę CVSS 9.8, co klasyfikuje go jako krytyczny.

W Traefik, popularnym reverse proxy dla środowisk Cloud Native, wykryto podatność umożliwiającą atakującemu zdalne usunięcie lub modyfikację krytycznych nagłówków HTTP (np. X-Forwarded-Host, X-Forwarded-Port) dodawanych przez proxy przed przekazaniem żądania do aplikacji. Jest to groźne, ponieważ aplikacje backendowe ufają wartościom tych nagłówków, co może prowadzić do poważnych naruszeń bezpieczeństwa.

W oprogramowaniu układowym sterownika AutomationDirect P3-550E występuje podatność typu code injection w funkcjonalności przetwarzającej plik scan_lib.bin. Podatność pozwala atakującemu na zdalne wykonanie dowolnego kodu bez uwierzytelnienia, co stanowi poważne zagrożenie dla środowisk przemysłowych (OT/ICS).

W przeglądarkach Firefox poniżej wersji 123 interfejs API fetch() oraz nawigacja nieprawidłowo współdzieliły tę samą pamięć podręczną (cache). Atakujący mógł zatruć lokalny cache przeglądarki, wstrzykując kontrolowaną odpowiedź, którą ofiara widziała zamiast oczekiwanej treści strony.

In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.

In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.

Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.

The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.

BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware. This can allow attackers to upload crafted firmware which contains backdoors and enables arbitrary code execution.

RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.

The Emerson ROC and FloBoss RTU product lines through 2022-05-02 perform insecure filesystem operations. They utilize the ROC protocol (4000/TCP, 5000/TCP) for communications between a master terminal and RTUs. Opcode 203 of this protocol allows a master terminal to transfer files to and from the flash filesystem and carrying out arbitrary file and directory read, write, and delete operations.

Honeywell Experion PKS Safety Manager (SM and FSC) through 2022-05-06 has Insufficient Verification of Data Authenticity. According to FSCT-2022-0053, there is a Honeywell Experion PKS Safety Manager insufficient logic security controls issue. The affected components are characterized as: Honeywell FSC runtime (FSC-CPU, QPP), Honeywell Safety Builder. The potential impact is: Remote Code Execution, Denial of Service. The Honeywell Experion PKS Safety Manager family of safety controllers utilize the unauthenticated Safety Builder protocol (FSCT-2022-0051) for engineering purposes, including downloading projects and control logic to the controller. Control logic is downloaded to the controller on a block-by-block basis. The logic that is downloaded consists of FLD code compiled to native machine code for the CPU module (which applies to both the Safety Manager and FSC families). Since this logic does not seem to be cryptographically authenticated, it allows an attacker capable of triggering a logic download to execute arbitrary machine code on the controller's CPU module in the context of the runtime. While the researchers could not verify this in detail, the researchers believe that the microprocessor underpinning the FSC and Safety Manager CPU modules is incapable of offering memory protection or privilege separation capabilities which would give an attacker full control of the CPU module. There is no authentication on control logic downloaded to the controller. Memory protection and privilege separation capabilities for the runtime are possibly lacking. The researchers confirmed the issues in question on Safety Manager R145.1 and R152.2 but suspect the issue affects all FSC and SM controllers and associated Safety Builder versions regardless of software or firmware revision. An attacker who can communicate with a Safety Manager controller via the Safety Builder protocol can execute arbitrary code without restrictions on the CPU module, allowing for covert manipulation of control operations and implanting capabilities similar to the TRITON malware (MITRE ATT&CK software ID S1009). A mitigating factor with regards to some, but not all, of the above functionality is that these require the Safety Manager physical keyswitch to be in the right position.