Saidakbarxon Maxsudxonov

**Name of the Vulnerable Software and Affected Versions** Kanboard versions prior to 1.2.53 **Description** Authenticated users can bypass server-side request forgery (SSRF) protections by using hexadecimal IP address notation in user-controlled URLs. Through the web link creation feature, attackers can submit hexadecimal-encoded internal IP addresses, leading cURL to connect to internal network resources, including localhost services, cloud instance metadata services, and RFC1918 addresses. This occurs because the `isPrivateURL()` function in `app/Core/Http/Client.php` incorrectly validates the input as safe since `FILTER VALIDATE IP` rejects non-dotted-decimal notation. **Recommendations** Update Kanboard to version 1.2.53 or later.

**Name of the Vulnerable Software and Affected Versions** AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface versions prior to 2.2.2 **Description** The Space Link Extension (SLE) interface manager lacks proper authentication, allowing unauthenticated network attackers to access seven unprotected API routes via direct HTTP requests. This allows attackers to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links. **Recommendations** Update AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface to version 2.2.2 or later.

**Name of the Vulnerable Software and Affected Versions** AMMOS Instrument Toolkit (AIT) GUI versions prior to 2.5.1 **Description** An authentication flaw allows an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. This is possible by calling the `Sessions.create()` function, which fails to perform credential checks. Once a session is established, an attacker can invoke the `handle cmd()` function to forward arbitrary commands directly to the AIT command bus, as there is no authentication gate between session creation and command dispatch. **Recommendations** Update AMMOS Instrument Toolkit (AIT) GUI to version 2.5.1 or later. As a temporary mitigation, restrict network access to the `Sessions.create()` and `handle cmd()` functions.

**Name of the Vulnerable Software and Affected Versions** sysPass versions prior to 3.2.12 **Description** Authenticated administrators can execute arbitrary commands as the web server process user by configuring a malicious backup path and triggering a backup. The `FileBackupService` constructs a tar shell command using string concatenation, incorporating the `siteBackupPath` variable without proper sanitization via `escapeshellarg()` or similar methods before passing it to the `exec()` function. This allows injected commands to persist and execute during every subsequent backup operation. **Recommendations** Update sysPass to a version newer than 3.2.11. As a temporary mitigation, avoid modifying the `siteBackupPath` setting and restrict access to the backup functionality.

**Name of the Vulnerable Software and Affected Versions** Grav CMS scheduler-webhook plugin (affected versions not specified) **Description** An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote attackers to trigger configured scheduled jobs by sending a POST request to the scheduler webhook endpoint. Attackers can execute all configured jobs or target a specific one, leading to the unintended execution of operator-defined commands under the privileges of the web server process user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cockpit CMS (affected versions not specified) **Description** A path traversal issue exists in the Bucket file storage API endpoint '/system/buckets/api'. The `api()` function in modules/System/Controller/Buckets.php uses a sanitization method that allows '..' and '../' sequences in the `bucket` variable. This allows the Flysystem WhitespacePathNormalizer to resolve the path to the uploads storage root. Consequently, an authenticated user with low privileges can list, upload, and delete files across all buckets, including those belonging to other users or roles. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cockpit CMS (affected versions not specified) **Description** Missing authorization in the Bucket file storage API endpoint '/system/buckets/api' allows authenticated users to bypass access control. The `api()` function in modules/System/Controller/Buckets.php executes commands such as `ls`, `upload`, `removefiles`, `rename`, and `createfolder` without verifying Access Control Lists (ACL) or user roles. Consequently, any authenticated user can perform all bucket operations on any named bucket, including those reserved for administrators. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cotonti Siena versions prior to 0.9.27 **Description** Authenticated users with PFS access can perform a stored cross-site scripting attack. This occurs when malicious HTML is supplied via the `ntitle` parameter, which is processed through the TXT filter in the 'pfs.main.php' endpoint. An attacker can create a folder with a crafted title containing script tags that are stored unescaped in the database. These scripts then execute in the browser of any user who views the folder listing, including administrators. **Recommendations** Update to a version newer than 0.9.26.

**Name of the Vulnerable Software and Affected Versions** Cotonti Siena versions prior to 0.9.27 **Description** A cross-site request forgery (CSRF) issue exists where unauthenticated attackers can modify administrator configurations. This occurs because the `admin.php` config update handler does not invoke the application's CSRF validation function. By tricking a logged-in administrator into submitting a forged POST request, an attacker can set the `pfsfilecheck` variable to 0. This action disables the Perfect Forward Secrecy (PFS) module's file extension whitelist, allowing any user with PFS access to upload and execute arbitrary PHP files on the server. **Recommendations** Update Cotonti Siena to a version newer than 0.9.26. Restrict access to the `admin.php` config update handler to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Typemill versions prior to 2.24.0 **Description** Authenticated attackers with Author-level privileges can read arbitrary files outside the content directory. This is possible by supplying traversal sequences in the `path` query parameter passed to the `getFile()` function within the `Storage` class when an empty folder argument is used. This action bypasses the traversal-prevention controls implemented in the `getFolderPath()` function. **Recommendations** Update to version 2.24.0 or later. As a temporary workaround, restrict access to the `getFile()` function or monitor the `path` parameter for traversal sequences.

**Name of the Vulnerable Software and Affected Versions** Pimcore CMS/DXP version 12.3.8 **Description** A sandbox bypass allows authenticated administrative attackers to execute arbitrary methods on PHP objects. This occurs due to empty `checkMethodAllowed()` and `checkPropertyAllowed()` implementations within the custom Twig SecurityPolicy. By supplying malicious Twig templates through the 'DataObject ClassDefinition LayoutText' component, attackers can perform arbitrary file reads and execute arbitrary database queries. Furthermore, the `pimcore *` function wildcard extends the bypass to all Pimcore Twig functions, potentially leading to remote code execution via PHP object gadget chains. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rxi microtar version 0.1.0 **Description** A stack-based buffer overflow occurs in the `raw to header()` function within `src/microtar.c`. The function uses `strcpy()` to copy 100-byte name and linkname fields of a TAR header without ensuring the source is null-terminated. Because the POSIX ustar format allows these fixed-width fields to be fully populated with non-null bytes, a crafted archive where the linkname field and subsequent padding lack a null terminator causes `strcpy()` to read and write beyond the boundaries of the 512-byte raw header stack buffer. A remote attacker can trigger this by providing a malicious TAR archive to be processed via `mtar open()`, `mtar read header()`, or `mtar find()`, leading to an out-of-bounds read and a stack buffer overflow, which may result in a denial of service or arbitrary code execution. **Recommendations** For version 0.1.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rxi microtar version 0.1.0 **Description** An integer overflow occurs in the `mtar next()` function within `src/microtar.c`. The function calculates the offset to the next record using 32-bit arithmetic. When the header size field is a multiple of 512 within the range 0xFFFFFC01-0xFFFFFE00, the addition wraps to 0, causing `mtar next()` to seek to the current record position rather than advancing. This leads to an infinite loop in `mtar find()` or any loop iterating entries with `mtar next()`, resulting in a denial of service characterized by uncontrolled CPU consumption at 100% with no recovery when processing a crafted tar archive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LiamBindle MQTT-C versions prior to 1.1.7 **Description** A heap-based out-of-bounds read and integer underflow exist in the `mqtt unpack publish response()` function within `src/mqtt.c`. A remote unauthenticated attacker who controls an MQTT broker or can inject traffic into an unencrypted session can cause a subscribed client to crash and potentially disclose adjacent heap memory by sending a crafted PUBLISH packet. The issue occurs because the function fails to verify that the `topic name size` field, read from the packet, plus overhead fits within the `remaining length` of the fixed-header. This leads to an integer underflow when calculating `application message size` using unsigned arithmetic, which is then passed to `memmove()`. For example, a packet with `topic name size` set to 0xFFFF and `remaining length` set to 7 causes the parse pointer to advance 65535 bytes beyond the receive buffer and results in an `application message size` near 2^32, crashing the process. **Recommendations** Update to a version later than 1.1.6. As a temporary workaround, restrict access to the `mqtt unpack publish response()` function or avoid connecting to untrusted MQTT brokers until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** microtar version 0.1.0 **Description** A stack-based buffer overflow occurs in the `raw to header()` function within src/microtar.c. This issue allows attackers to corrupt adjacent stack memory by providing a specially crafted TAR archive containing `name` or `linkname` fields that are not null-terminated. The function utilizes `strcpy()` to copy 100-byte ustar format fields; when these fields lack null terminators, it can result in writes of up to 355 bytes into a 100-byte destination buffer. This happens when the `mtar open()`, `mtar find()`, or `mtar read header()` functions process the malicious archive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.