Xavlimsg

**Nome do Software Vulnerável e Versões Afetadas** Keycloak (versões afetadas não especificadas) **Description** Um problema de controle de acesso quebrado existe no endpoint de busca de usuários dos Recursos de Conta. Um usuário remoto autenticado que possua pelo menos um recurso de User-Managed Access (UMA) pode enumerar e coletar informações de identificação pessoal (PII) de todos os usuários do realm. Ao enviar solicitações manipuladas com nomes de usuário ou valores de e-mail arbitrários para o endpoint, o sistema retorna objetos de perfil completos de usuários não relacionados, resultando em uma ampla divulgação de informações em nível de perfil. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Node.js versions 25.x **Description** A flaw in the Node.js Permission Model’s network enforcement allows Unix Domain Socket (UDS) server operations to proceed without the necessary permission checks. All other network paths correctly enforce these checks. Consequently, code running under `--permission` without `--allow-net` can create and expose local Inter-Process Communication (IPC) endpoints, enabling communication with other processes on the same host, bypassing the intended network restriction boundary. The `--allow-net` feature is currently experimental. **Recommendations** For Node.js version 25.x, avoid running processes under `--permission` without including the `--allow-net` flag to restrict network access.

**Nome do Software Vulnerável e Versões Afetadas** MiCode FileExplorer (versões afetadas não especificadas) **Descrição** O software contém um bypass de autenticação no componente do servidor FTP SwiFTP incorporado. Isso permite que atacantes na rede façam login sem credenciais válidas, enviando combinações arbitrárias de nome de usuário e senha para o manipulador do comando `PASS`, que concede acesso incondicionalmente. A exploração bem-sucedida permite que os atacantes listem, leiam, escrevam e excluam arquivos expostos pelo servidor FTP. O projeto de código aberto MiCode/Explorer atingiu o status de fim de vida. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** VideoLAN VLC for Android versions prior to 3.7.0 **Description** The Remote Access Server feature in VideoLAN VLC for Android has an authentication bypass due to inadequate rate limiting on one-time password (OTP) verification. The server utilizes a 4-digit OTP but lacks effective throttling or lockout mechanisms during the OTP validity period. An attacker with network access can repeatedly attempt OTP verification to obtain a valid `user session` cookie, leading to unauthorized access to the Remote Access interface. Access is limited to media files shared by the VLC for Android user through the interface. The affected API endpoint is not explicitly mentioned. **Recommendations** Update VideoLAN VLC for Android to version 3.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** jishi node-sonos-http-api versions prior to 3776f0ee2261c924c7b7204de121a38100a08ca7 **Description** A flaw exists in jishi node-sonos-http-api that could allow for remote execution of operating system commands. The issue is related to the manipulation of the `phrase` argument within the `Promise` function located in the `lib/tts-providers/mac-os.js` file of the TTS Provider component. The exploit for this issue has been publicly released. **Recommendations** Update jishi node-sonos-http-api to a version later than 3776f0ee2261c924c7b7204de121a38100a08ca7.

**Name of the Vulnerable Software and Affected Versions** Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versions prior to 3.0.9 **Description** The Galaxy FDS Android SDK disables TLS hostname verification when HTTPS is enabled by default. Specifically, the `createHttpClient()` function within the `GalaxyFDSClientImpl` class configures Apache HttpClient with `SSLSocketFactory.ALLOW ALL HOSTNAME VERIFIER`, accepting any TLS certificate regardless of hostname mismatch. This allows a man-in-the-middle attacker to intercept and modify communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status. **Recommendations** Versions prior to 3.0.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DNSdist (affected versions not specified) **Description** An attacker may be able to cause DNSdist to allocate excessive memory when handling DNS over QUIC or DNS over HTTP/3 payloads, potentially leading to a denial of service. In some scenarios, the system might experience an out-of-memory condition and terminate the process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.