Jfoz1010

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versões anteriores a 0.312.3 Description Os manipuladores de assinatura WebSocket do Strawberry GraphQL para os protocolos `graphql-transport-ws` e `graphql-ws` legados alocam uma `asyncio.Task` e um objeto `Operation` associado para cada mensagem de inscrição recebida, sem limitar o número de assinaturas ativas por conexão. Um invasor não autenticado pode abrir uma conexão WebSocket, enviar uma mensagem connection init e inundar com mensagens de inscrição com IDs exclusivos. Cada mensagem gera incondicionalmente uma nova `asyncio.Task` e um gerador assíncrono, levando ao crescimento linear do uso de memória e à saturação do loop de eventos, o que pode causar degradação do servidor ou uma falha por falta de memória (OOM). Recommendations Atualize para a versão 0.312.3 ou posterior do Strawberry GraphQL.

**Name of the Vulnerable Software and Affected Versions** Admidio versions 5.0.0 through 5.0.7 **Description** Admidio relies on `.htaccess` files to restrict direct HTTP access to uploaded documents. The Docker image is configured with `AllowOverride None` in the Apache configuration, causing these `.htaccess` files to be ignored. This allows anyone with knowledge of the file path to access uploaded files without authentication, regardless of role-based permissions set within the user interface. The file path is disclosed in the upload response JSON. The vulnerability bypasses role-based access control at the filesystem level, potentially exposing sensitive organizational documents like contracts, member data, and financial records. The upload API response discloses the direct URL to the uploader, simplifying path enumeration. **Recommendations** Versions 5.0.0 through 5.0.7: Enable `AllowOverride All` in the Apache configuration for the `/opt/app-root/src/adm my files` directory. Versions 5.0.0 through 5.0.7: Move uploaded files to a directory outside the web root and serve them exclusively through Admidio’s download handler (`modules/documents-files.php?mode=download`). Versions 5.0.0 through 5.0.7: Configure an explicit deny rule at the Apache level for the `/opt/app-root/src/adm my files` directory.

**Name of the Vulnerable Software and Affected Versions** Admidio versions 5.0.0 through 5.0.7 **Description** The `delete` mode handler in `mylist function.php` does not validate a CSRF token before permanently deleting list configurations. An attacker can exploit this by luring an authenticated user to a malicious page, which can result in the silent destruction of the user's list configurations, including organization-wide shared lists if the victim has administrator rights. The vulnerable code is located in the `modules/groups-roles/mylist function.php` file, specifically within the `delete` case at lines 159-161, where the `delete()` function is called without CSRF validation. The vulnerability is triggered by a malicious page containing a form that submits a POST request to the ''/modules/groups-roles/mylist function.php'' endpoint with the `mode` parameter set to 'delete' and the `list uuid` parameter set to the target list's UUID. The `column[]` parameter is also required, but any static value is sufficient. The vulnerable parameter is `adm csrf token`, which is not checked during the delete operation. **Recommendations** Apply the `SecurityUtils::validateCsrfToken()` pattern to the `delete` mode handler in `mylist function.php`, similar to the save modes. Move the `column[]` input guard to within the `in array($getMode, ['save', 'save as', 'save temporary'])` block.

**Name of the Vulnerable Software and Affected Versions** APTRS versions prior to 2.0.1 **Description** APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool. A flaw exists in the `edit user` API endpoint ('/api/auth/edituser/<pk>') where a user can elevate their privileges to superuser by submitting a crafted request. Specifically, including `"is superuser": true` in the request body allows unauthorized modification of the `is superuser` attribute. The issue stems from the `CustomUserSerializer` exposing the `is superuser` field as writable without proper validation within the `edit user` view. Successful exploitation grants unrestricted access to all application functionality without re-authentication. The vulnerable parameter is `is superuser`. **Recommendations** Update to version 2.0.1 or later.

Nome do Software Vulnerável e Versões Afetadas: Nginx Proxy Manager versão 2.12.3 Descrição: Uma má configuração de Cross-Origin Resource Sharing (CORS) permite que domínios não autorizados acessem dados sensíveis, especificamente JSON Web Tokens (JWT), devido à validação inadequada do cabeçalho Origin. Isso permite que atacantes interceptem tokens usando um script de navegador e os exfiltrem para um servidor remoto controlado pelo atacante, potencialmente levando a ações não autorizadas. Recomendações: Atualize o Nginx Proxy Manager para uma versão que corrija esta má configuração.

**Name of the Vulnerable Software and Affected Versions** heimdall version 2.6.3-ls307 **Description** The application does not properly validate user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. This allows for Host Header Injection and Open Redirect attacks. An unauthenticated remote attacker can manipulate these headers to load external resources from attacker-controlled domains and redirect users, potentially enabling phishing, UI redress, and session theft. The issue is due to insufficient validation of untrusted input, impacting the application’s integrity and trustworthiness. **Recommendations** Apply input validation and sanitization to the `X-Forwarded-Host` and `Referer` HTTP headers to prevent manipulation.