Nicowaisman

**Name of the Vulnerable Software and Affected Versions** 2FAuth versions prior to 5.4.1 **Description** The issue is related to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. An attacker can upload a malicious SVG containing JS code, which could compromise a victim's session and access to their tokens if the victim is driven to the uploaded image. **Recommendations** For versions prior to 5.4.1, update to version 5.4.1 to resolve the issue. As a temporary workaround, consider restricting the upload of SVG files or disabling the feature that allows image uploads until the patch is applied. Avoid using the affected account migration feature until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** 2FAuth version 5.4.1 2FAuth versions prior to 5.4.1 **Description** 2FAuth is a web application used to manage Two-Factor Authentication (2FA) accounts and generate their security codes. It contains two interconnected vulnerabilities: a Server-Side Request Forgery (SSRF) issue and a URI validation bypass issue. The `POST /api/v1/twofaccounts/preview` endpoint allows setting a remote URI to retrieve the image of a 2FA site. An attacker can abuse this functionality to force the application to make a GET request to an arbitrary URL. The library attempts to filter out URIs without an image extension but can be bypassed by appending `#.svg` to the URI. This combination of issues enables an attacker to retrieve URIs accessible from the application if their content type is text-based. **Recommendations** For 2FAuth version 5.4.1 and earlier, update to version 5.4.1 or later to fix the issues. As a temporary workaround, consider restricting access to the `POST /api/v1/twofaccounts/preview` endpoint until a patch is applied. Avoid using the `POST /api/v1/twofaccounts/preview` endpoint with untrusted input until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Scoold versions prior to 1.64.0 Description: A semicolon path injection vulnerability was found on the "/api;/config" endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorized access to sensitive configuration data. Furthermore, PUT requests on the "/api;/config" endpoint while setting the `Content-Type: application/hocon` header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sensitive information such as configuration files from the server, which can be leveraged for further exploitation. Recommendations: For versions prior to 1.64.0, update to Scoold 1.64.0 to fix the vulnerability. As a temporary workaround, consider disabling the Scoold API by setting `scoold.api enabled = false`.

**Name of the Vulnerable Software and Affected Versions** Sourcegraph versions prior to 3.15.1 **Description** The issue is related to a vulnerable authentication workflow due to improper validation in the `SafeRedirectURL` method. This method, located in `cmd/frontend/auth/redirect.go`, fails to properly validate URLs, which can be exploited. For example, the substring `//foo//example.com` can be used to bypass validation. **Recommendations** For versions prior to 3.15.1, update to version 3.15.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `SafeRedirectURL` method in `cmd/frontend/auth/redirect.go` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** cnlh nps versions 0.23.2 and earlier **Description** The issue arises from the use of 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps in lib/install/install.go, allowing a local user to overwrite files. **Recommendations** For versions 0.23.2 and earlier, consider changing the permissions of /usr/local/bin/nps and /usr/bin/nps to prevent file overwrites by local users. As a temporary workaround, restrict access to these files until a proper fix is applied.