Witold Gorecki

**Name of the Vulnerable Software and Affected Versions** Directus versions prior to 9.16.0 **Description** The issue allows users with read access to the `password` field in `directus users` to extract argon2 password hashes by brute forcing the export functionality combined with a ` starts with` filter. This enables the enumeration of password hashes. However, taking over accounts is unlikely with current hardware unless the hashes can be reversed. **Recommendations** For versions prior to 9.16.0, upgrade to version 9.16.0 or later to patch the issue. As a temporary workaround for users unable to upgrade, ensure that no user has `read` access to the `password` field in `directus users`.

**Name of the Vulnerable Software and Affected Versions** Cloudflow (affected versions not specified) **Description** The issue allows attackers to retrieve confidential information from the system due to a Local File Inclusion vulnerability within Cloudflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cloudflow (affected versions not specified) **Description** The issue allows an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage without authentication. This is due to an unauthenticated file upload vulnerability in Cloudflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Nome do software vulnerável e versões afetadas** Versões do Directus anteriores à 9.15.0 **Descrição** O processo do Directus pode ser interrompido se um usuário autorizado atualizar o valor `filename disk` para uma pasta e acessar esse arquivo através do endpoint “/assets”. Esta falha já foi corrigida e a versão 9.15.0 contém a correção. Recomenda-se que os usuários atualizem para evitar o problema. **Recomendações** Para versões anteriores à 9.15.0, atualize para a versão 9.15.0 ou posterior para resolver o problema. Como solução alternativa temporária para usuários que não possam atualizar, evite o problema garantindo que nenhum usuário não administrador (não confiável) tenha permissões para atualizar o campo `filename disk` em `directus files`.