#php

## Impacted Resources bref/src/Event/Http/Psr7Bridge.php:94-125 ## Description When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in `/tmp` with a random filename starting with `bref_upload_`. The function implementing the logic follows: ```php private static function parseBodyAndUploadedFiles(HttpRequestEvent $event): array { $bodyString = $event->getBody(); $files = []; $parsedBody = null; $contentType = $event->getContentType(); if ($contentType !== null && $event->getMethod() === 'POST') { if (str_starts_with($contentType, 'application/x-www-form-urlencoded')) { parse_str($bodyString, $parsedBody); } else { $document = new Part("Content-type: $contentType\r\n\r\n" . $body...

Threat actors are using all the tools at their disposal to deliver malware. Malicious ads are only one step in the chain, with compromised sites providing the free hosting and changing capabilities that can evade detection.

XenForo versions 2.2.13 and below suffer from a zip slip filename traversal vulnerability in ArchiveImport.php.

TELSAT marKoni FM Transmitter version 1.9.5 allows an unauthorized user to change passwords.

TELSAT marKoni FM Transmitter version 1.9.5 implements client-side restrictions that can be bypassed by editing the HTML source page that enable administrative operations.

TELSAT marKoni FM Transmitter version 1.9.5 has a hidden super administrative account factory that has the hardcoded password inokram25 that allows full access to the web management interface configuration.

TELSAT marKoni FM Transmitter version 1.9.5 is susceptible to unauthenticated remote code execution with root privileges. An attacker can exploit a command injection vulnerability by manipulating the Email settings' WAN IP info service, which utilizes the wget module. This allows the attacker to gain unauthorized access to the system with administrative privileges by exploiting the url parameter in the HTTP GET request to ekafcgi.fcgi.

Cybersecurity researchers are calling attention to the "democratization" of the phishing ecosystem owing to the emergence of Telegram as an epicenter for cybercrime, enabling threat actors to mount a mass attack for as little as $230. "This messaging app has transformed into a bustling hub where seasoned cybercriminals and newcomers alike exchange illicit tools and insights creating a dark and

Interactive Floor Plan version 1.0 suffers from a cross site scripting vulnerability.

Chrome version 121 suffers from a javascript fork malloc vulnerability that indicates memory corruption upon crash.