Ratrarity

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.7.0 through 11.7.2 Mattermost versions 11.6.0 through 11.6.4 Mattermost versions 10.11.0 through 10.11.19 **Description** The shared channel inbound sync handler fails to verify post ownership. This allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes by sending crafted sync messages that reference arbitrary post IDs within channels shared with that remote. **Recommendations** Update Mattermost versions 11.7.0 through 11.7.2 to a version newer than 11.7.2. Update Mattermost versions 11.6.0 through 11.6.4 to a version newer than 11.6.4. Update Mattermost versions 10.11.0 through 10.11.19 to a version newer than 10.11.19.

**Name of the Vulnerable Software and Affected Versions** Ghostfolio versions prior to 2.245.0 **Description** Ghostfolio, an open source wealth management software, contains a server-side request forgery (SSRF) issue. An attacker can exploit the manual asset import feature to perform a full-read SSRF. This allows the attacker to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. The API endpoint used for asset import is vulnerable. The `asset import` function is susceptible to exploitation. **Recommendations** Update to version 2.245.0.

**Name of the Vulnerable Software and Affected Versions** Ghostfolio versions prior to 2.244.0 **Description** Ghostfolio is a wealth management software susceptible to arbitrary SQL command execution. An attacker can bypass symbol validation to execute SQL commands through the `getHistorical()` method. Successful exploitation could allow an attacker to read, modify, or delete sensitive financial data for all users in the database. **Recommendations** Update to version 2.244.0 or later.