Geochen

**Name of the Vulnerable Software and Affected Versions** jxxghp MoviePilot versions prior to 2.13.6 **Description** An issue exists within the Application API component in the `/jxxghp/MoviePilot` file. A flaw in an unknown function allows for improper authorization, which can be exploited remotely. **Recommendations** Apply the patch identified as `dc2b6910a423b3bfadeffaa303e1ba75cfb33900` for versions prior to 2.13.6.

**Name of the Vulnerable Software and Affected Versions** IceHRM versions prior to 35.0.2 **Description** A remote SQL injection flaw exists in the UserReport component within the file `core/src/Reports/User/Reports/EmployeeAttendanceReport.php`. The issue occurs when the `employeeList` argument is manipulated, allowing an attacker to execute unauthorized SQL commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `employeeList` argument in the affected component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Bahmni bahmnicore versions prior to 0.93.1 **Description** An issue exists in the Search Endpoint component where the `additionalParams` function within the '/openmrs/ws/rest/v1/bahmnicore/sql' endpoint is susceptible to SQL injection. This occurs when the `test` argument is manipulated, allowing a remote attacker to execute unauthorized SQL commands. **Recommendations** Upgrade to version 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, or 2.0.1. As a temporary mitigation, restrict access to the '/openmrs/ws/rest/v1/bahmnicore/sql' endpoint or avoid using the `test` argument.

**Name of the Vulnerable Software and Affected Versions** tumf mcp-text-editor versions prior to 1.0.3 **Description** A path traversal issue exists in the ` validate file path()` function within the `mcp text editor/text editor.py` file. This flaw allows a remote attacker to manipulate the `file path` argument to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** Update tumf mcp-text-editor to version 1.0.3 or later. As a temporary workaround, restrict access to the ` validate file path()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** bentoml OpenLLM version 0.6.30 **Description** Command injection is possible within the Model Repository Directory Name Handler component. This occurs when the `cmd` argument is manipulated in the `async run command()` function located in the `src/openllm/common.py` file. Successful exploitation requires local access to the system. **Recommendations** As a temporary workaround, restrict access to the `async run command()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Harness versions prior to 2.28.2 **Description** A remote authorization bypass exists within the gitspaces component. The issue resides in the `getAuthorizedSpaces()` function located in the `app/api/controller/gitspace/list all.go` file. An attacker can execute a manipulation to bypass authorization controls. **Recommendations** Update Harness to a version later than 2.28.2. As a temporary mitigation, restrict access to the `getAuthorizedSpaces()` function.

**Name of the Vulnerable Software and Affected Versions** crater-invoice-inc crater versions prior to 6.0.7 **Description** A weakness in the Invoice Note Handler component allows for remote cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue resides in the `getFormattedString()` function within the `app/Http/Requests/InvoicesRequest.php` file. An attacker can trigger this by manipulating the `notes` argument. **Recommendations** Update crater-invoice-inc crater to version 6.0.7 or later. As a temporary workaround, restrict the use of the `notes` argument in the Invoice Note Handler until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Formbricks version 5.0.0 **Description** Improper access controls exist within the Survey Handler component, specifically affecting a function in the `apps/web/modules/survey/link/actions.ts` file. This flaw allows for remote exploitation. **Recommendations** Upgrade to version 5.1.0-rc.1.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions prior to 4.18.1 **Description** An authorization bypass exists in the `reorder-sets` endpoint. A remote attacker can manipulate the `actionReorderSets()` function within the `src/controllers/GlobalsController.php` file to bypass security checks. **Recommendations** Update to version 4.18.1. As a temporary mitigation, restrict access to the `actionReorderSets()` function.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions prior to 4.18.1 **Description** An improper authorization issue exists in the Charts Endpoint component within the `actionGetNewUsersData()` function of the `src/controllers/ChartsController.php` file. A remote attacker can exploit this by manipulating the `userGroupId` argument. **Recommendations** Upgrade to version 4.18.1.

**Name of the Vulnerable Software and Affected Versions** GitBucket versions prior to 4.46.2 **Description** A server-side request forgery (SSRF) exists that allows remote attackers to manipulate the `url` argument within the `Git.cloneRepository.setURI()` function located in the `src/main/scala/gitbucket/core/service/RepositoryCreationService.scala` file. SSRF is a flaw where an attacker can force the server to make requests to an unintended location. **Recommendations** Deploy patch 487a9b980f56aa73b6a044b1e86a92eed5043215 for versions prior to 4.46.2.

**Name of the Vulnerable Software and Affected Versions** ILIAS Learning Management System version 11.0 **Description** An issue exists in the Learning Progress Tracking component within the `ilTrQuery::executeQueries()` function of the `components/ILIAS/Tracking/classes/class.ilTrQuery.php` file. Remote manipulation of the `troup table nav` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** lemonldap-ng versions prior to 2.23.1 **Description** An issue exists in the SAML Common Domain Cookie Endpoint within the library `lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm`. A remote attacker can perform a manipulation of the `url` argument, leading to an open redirect. An open redirect occurs when an application takes a user-provided input and uses it in a redirect without sufficient validation, allowing attackers to redirect users to malicious external sites. **Recommendations** Update to a version later than 2.23.0. Avoid using the `url` argument in the affected SAML Common Domain Cookie Endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Huly Platform versions prior to 0.7.1 **Description** Improper access controls in the RPC Interface component allow for remote attacks. The issue is located in the `getMailboxSecret()` function within the `server/account/src/operations.ts` file. **Recommendations** Update to a version later than 0.7.0. As a temporary workaround, restrict access to the `getMailboxSecret()` function.

**Name of the Vulnerable Software and Affected Versions** Huly Platform versions prior to 0.7.0 **Description** Improper authorization exists in the User Information Handler component. A remote attacker can manipulate the `getAccountInfo()` function within the `server/account/src/operations.ts` file to bypass authorization controls. **Recommendations** Update to a version later than 0.7.0. As a temporary workaround, restrict access to the `getAccountInfo()` function until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** TwiN gatus version 5.36.0 **Description** A flaw exists in the OIDC Session Cookie Handler component within the `setSessionCookie()` function of the `security/oidc.go` file. A remote attacker can perform a high-complexity manipulation to cause sensitive cookies to be issued without the secure attribute, which ensures cookies are only transmitted over encrypted connections. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bolt CMS versions prior to 3.7.6 **Description** An issue exists in the HTML Attribute Handler component within the file `src/Storage/Field/Type/TextType.php`. A remote attacker can perform HTML injection by manipulating the `style` argument. This affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination System version 1.0 **Description** A flaw exists in code-projects Online Examination System 1.0 related to functionality within the `/admin pic.php` file. This allows for unrestricted file uploads, potentially exploitable from a remote location. The details of the exploit have been publicly released. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination System version 1.0 **Description** A flaw exists in the Online Examination System that allows for remote SQL injection. This occurs through manipulation of the `User` argument within the /index.php file, specifically related to the Login Page component. The exploit for this issue has been publicly disclosed. **Recommendations** Apply any available updates or patches to address the SQL injection vulnerability in the /index.php file. As a temporary workaround, consider restricting or carefully validating the `User` input parameter to prevent malicious SQL code injection.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Examination System version 1.0 **Description** A flaw exists in the Add Pages component of the software, allowing for cross site scripting. This manipulation can be executed remotely. The exploit details have been publicly disclosed. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.