aydinnyunus

1. Overview

A security vulnerability has been discovered in Akaunting, an open-source online accounting software. The issue allows an attacker to install paid applications for free, leading to further exploitation, including remote code execution (RCE) and local privilege escalation (LPE). This report outlines the details of the vulnerability, its impact, and potential mitigation steps.

---

2. Description of the Vulnerability

2.1 Business Logic Bug in Application Purchase System

Akaunting offers an App Store where users can purchase and install various applications to extend functionality. A flaw in the request processing allows an attacker to:

• Modify request parameters (name, version, path) to install paid applications for free.

aydinnyunus

CVE Description: File Upload Bypass in NestJS Due to Insufficient MIME Type Validation

CVE-2024-29409
File Upload Bypass Vulnerability in NestJS file-type.validator.ts

Vulnerability Summary: A file upload bypass vulnerability exists in the file-type.validator.ts implementation within the NestJS framework (versions prior to 10.x.x) that allows attackers to bypass MIME type checks during file uploads. The flaw arises from an incorrect or insufficient validation of the Content-Type header and the actual file content type. This allows an attacker to upload files with a mismatched Content-Type, leading to possible security issues, such as remote code execution, file disclosure, or data exfiltration.

Vulnerable Component:

• Component: @nestjs/common

aydinnyunus

Vulnerability Report: Bypass in isPrivate() Function

CVE-2024-28607

Summary: An issue in the isPrivate() function of the NPM ip-utils package (version 2.4.0 and before) allows an attacker to bypass private IP detection, potentially leading to security risks such as unauthorized access, SSRF, or information leakage.

• https://github.com/librasean/IP-Utils/blob/4f88799f94f21efe6ea9135129ab2bbeb0c58edc/src/IsPrivate.ts#L4

---

aydinnyunus

Vulnerability Report: Execution of Arbitrary Code via scontrol show hostname Command in BasicSR

Vulnerability Overview: An issue has been identified in BasicSR version 1.4.2 and earlier versions, maintained by XPixelGroup, which allows a local attacker to execute arbitrary code through the scontrol show hostname command within the init_dist_slurm function. This vulnerability exists due to insufficient input validation in handling environment variables used for CUDA device setup.

Vulnerability Details:

• CVE-ID: CVE-2024-27763
• CVSS Score: (Pending assessment)
• Impact: Local attackers can exploit this vulnerability to execute arbitrary code within the context of the application, potentially leading to unauthorized access, privilege escalation, or denial of service.

aydinnyunus

from sklearn.linear_model import LogisticRegression
from sklearn.linear_model import LinearRegression
import pandas as pd
import numpy as np

df = pd.read_csv('W.csv',sep = ',')
df['Height']= df.Height*2.54
df['Weight'] = df.Weight*0.45
Gender = df[df.columns[0]]
HW = df[df.columns[1:3]]

aydinnyunus

from numpy import exp,array,random,dot

class NeuralNetwork():
	def __init__(self):
		random.seed(1)
		self.synaptic_weights = 2* random.random((3,1))-1

	def __sigmoid(self,x):
		return 1/(1+exp(-x))

aydinnyunus

import pandas as pd
from sklearn.feature_extraction.text import TfidfVectorizer
from sklearn.metrics.pairwise import linear_kernel

ds = pd.read_csv("sample-data.csv")

tf = TfidfVectorizer(analyzer='word', ngram_range=(1, 3), min_df=0, stop_words='english')
tfidf_matrix = tf.fit_transform(ds['description'])

cosine_similarities = linear_kernel(tfidf_matrix, tfidf_matrix)

aydinnyunus

import json
from difflib import get_close_matches

data = json.load(open("data.json"))

def translate(word):
    word = word.lower()
    if word in data:
        return data[word]
    elif word.title() in data:

aydinnyunus

import numpy as np
from sklearn.preprocessing import Imputer
from sklearn.neighbors import KNeighborsClassifier
from sklearn.metrics import accuracy_score
import pandas as pd
from sklearn import cross_validation

veri = pd.read_csv("cancer.data")

veri.replace("?",-99999,inplace=True)

aydinnyunus

# get current date in required format 
import datetime 
  
# store the birthdates of your contacts 
import json 
   
from selenium import webdriver 
   
# add a delay so that all elements of 
# the webpage are loaded before proceeding