{"id":105840,"date":"2022-12-05T15:36:44","date_gmt":"2022-12-05T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract"},"modified":"2022-12-05T15:36:44","modified_gmt":"2022-12-05T13:36:44","slug":"uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","title":{"rendered":"Vulnerabilit\u00e0 in VS Code, Grafana, GNU Emacs e Apache Fineract","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Alcune vulnerabilit\u00e0 recentemente scoperte:  <\/p>\n<ul>\n<li class=\"l\"> \u00c8 stata rilevata una vulnerabilit\u00e0 critica nell'editor Visual Studio Code (VS Code) (CVE-2022-41034) che consente di eseguire codice aprendo un link preparato dall'attaccante. Il codice pu\u00f2 essere eseguito sia sul computer con VS Code che su qualsiasi altro computer connesso a VS Code tramite la funzione 'Remote Development'. Il problema rappresenta il maggior rischio per gli utenti della versione web di VS Code e per gli editor web basati su di essa, tra cui GitHub Codespaces e github.dev.\n<p>La vulnerabilit\u00e0 \u00e8 causata dalla possibilit\u00e0 di elaborare link di comando 'command:' per aprire una finestra del terminale ed eseguire comandi shell arbitrari, quando si elaborano nel editor documenti appositamente formattati in Jupyter Notebook, caricati da <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/server\/\"   title=\"server web\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"765\">server web<\/a>, sotto il controllo dell'attaccante (file esterni con estensione '.ipynb' vengono aperti senza ulteriori conferme in modalit\u00e0 'isTrusted', che consente di elaborare 'command:').    <\/p>\n<li class=\"l\"> In GNU Emacs \u00e8 stata trovata una vulnerabilit\u00e0 (CVE-2022-45939) che consente di eseguire comandi all'apertura di un file di codice, attraverso la sostituzione di caratteri speciali nel nome, elaborato tramite lo strumento ctags.\n<li class=\"l\"> Nella piattaforma aperta di visualizzazione dei dati Grafana \u00e8 stata trovata una vulnerabilit\u00e0 (CVE-2022-31097) che consente l'esecuzione di codice JavaScript quando viene visualizzato un avviso tramite il sistema Grafana Alerting. Un attaccante con diritti di editor (Editor) pu\u00f2 preparare un link formattato specialmente e ottenere accesso all'interfaccia Grafana con diritti di amministratore nel caso in cui l'amministratore segua quel link. La vulnerabilit\u00e0 \u00e8 stata risolta nelle versioni Grafana 9.2.7, 9.3.0, 9.0.3, 8.5.9, 8.4.10 e 8.3.10.\n<li class=\"l\"> Vulnerabilit\u00e0 (CVE-2022-46146) nella libreria exporter-toolkit, utilizzata per creare moduli di esportazione delle metriche per Prometheus. Il problema consente di bypassare l'autenticazione di base.\n<li class=\"l\"> Una vulnerabilit\u00e0 (CVE-2022-44635) nella piattaforma di creazione di servizi finanziari Apache Fineract consente a un utente non autenticato di ottenere l'esecuzione remota di codice. Il problema \u00e8 causato dall'assenza di una corretta validazione dei caratteri '..' nei percorsi elaborati dal componente per il caricamento di file. La vulnerabilit\u00e0 \u00e8 stata risolta nelle versioni Apache Fineract 1.7.1 e 1.8.1.\n<li class=\"l\"> Vulnerabilit\u00e0 (CVE-2022-46366) nel framework Java Apache Tapestry, che consente l'esecuzione di codice maligno durante la deserializzazione di dati appositamente formattati. Il problema si manifesta solo nella vecchia versione di Apache Tapestry 3.x, che non \u00e8 pi\u00f9 supportata.\n<li class=\"l\"> Vulnerabilit\u00e0 nei provider Apache Airflow per Hive (CVE-2022-41131), Pinot (CVE-2022-38649), Pig (CVE-2022-40189) e Spark (CVE-2022-40954), che portano all'esecuzione remota di codice attraverso il caricamento di file arbitrari o la sostituzione di comandi nel contesto dell'esecuzione dei job, senza avere accesso in scrittura ai file DAG.                <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58264\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0441\u044b\u043b\u043a\u0438, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c. \u041a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d \u043a\u0430\u043a \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0441 VS Code, \u0442\u0430\u043a \u0438 \u043d\u0430 \u043b\u044e\u0431\u044b\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0445 \u043a VS Code \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 &#171;Remote Development&#187;. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043d\u0430\u0438\u0431\u043e\u043b\u044c\u0448\u0443\u044e \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0434\u043b\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105840","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VS Code, Grafana, GNU Emacs \u0438 Apache Fineract | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-12-05T13:36:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-05T13:36:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in VS Code, Grafana, GNU Emacs e Apache Fineract | ProHoster","description":"Alcune vulnerabilit\u00e0 recentemente scoperte: nel editor Visual Studio Code (VS Code) \u00e8 stata trovata una vulnerabilit\u00e0 critica (CVE-2022-41034) che consente l'esecuzione di codice all'apertura.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VS Code, Grafana, GNU Emacs \u0438 Apache Fineract | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0412 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0435 Visual Studio Code (VS Code) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-41034), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-vs-code-grafana-gnu-emacs-i-apache-fineract","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-05T13:36:44+00:00","article:modified_time":"2022-12-05T13:36:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"105840","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:31:51","updated":"2026-02-08 20:31:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/105840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=105840"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/105840\/revisions"}],"predecessor-version":[{"id":157956,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/105840\/revisions\/157956"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=105840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=105840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=105840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}