Skelmis

**Name of the Vulnerable Software and Affected Versions** OpenObserve versions through 0.9.1 **Description** The OpenObserve open-source observability platform has a security issue where it does not sanitize user input in the filter selection menu, potentially leading to complete account takeover. The front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) in many areas, but certain parts lack this protection. Combining the missing protection with insecure authentication handling, a malicious user may be able to take over any victim's account if they meet the exploitation steps. **Recommendations** For versions through 0.9.1, as a temporary workaround, consider restricting access to the filter selection menu until a patch is available. Additionally, review the authentication handling to ensure it is secure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Emby Media Server version 4.8.3.0 **Description** A Stored Cross Site Scripting issue allows a remote attacker to escalate privileges via the notifications.html component. **Recommendations** For Emby Media Server version 4.8.3.0, consider disabling access to the notifications.html component until a patch is available to prevent privilege escalation.

**Name of the Vulnerable Software and Affected Versions** Firefly III versions prior to 6.1.17 **Description** An MFA bypass exists in the OAuth flow of Firefly III, which allows malicious users to circumvent the multi-factor authentication check. This flaw enables attackers to use password spraying—a technique where common passwords are tried against many accounts—to gain access to data using credentials stolen from other sources. Because OAuth applications use an incrementing ID, they are easily enumerable, allowing an attacker to potentially register an OAuth application to a user's profile. Successful exploitation requires the attacker to possess the victim's username and password. **Recommendations** Update to version 6.1.17 or later. Use a unique password for the instance and store it securely in a password manager.

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions prior to 2.50.0 **Description** ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. **Recommendations** For versions prior to 2.50.0, update to version 2.50.0 or later to resolve the issue. As a temporary workaround, consider restricting access to (T)OTP checks until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Piccolo Admin versions prior to 1.3.2 **Description** The issue concerns the Piccolo Admin interface, which allows media file uploads, including SVG files by default. An attacker can upload a malicious SVG file, which, when loaded, can provide arbitrary access to the admin page. This access enables the attacker to perform various actions, such as gaining access to all data stored within the admin page, creating, modifying, or deleting table records. The vulnerability exploits the context of an authenticated admin session, allowing the attacker to make actions that would normally be restricted. **Recommendations** For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the upload of SVG files or restricting access to the admin panel to minimize the risk of exploitation. Additionally, ensuring proper security headers are set, such as XSS protection and a content security policy, can help mitigate the vulnerability. Modifying the Piccolo template generation to include these security headers by default or forcing the browser to download attachments instead of rendering them inline can also be considered.

**Name of the Vulnerable Software and Affected Versions** Piccolo versions prior to 1.1.1 **Description** The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. This could allow a malicious user to have direct access to the database and modify data to the level of permissions associated with the database user. Possible actions based on database permissions include reading all data stored in the database, inserting arbitrary data, and gaining a shell on the underlying server. **Recommendations** For versions prior to 1.1.1, update to version 1.1.1 to fix the issue. As a temporary workaround, consider restricting access to the `savepoint` method to minimize the risk of exploitation. Avoid passing user-provided input directly to `connection.execute` without proper escaping. Ensure all strings passed to `connection.execute` are properly escaped, regardless of how end-user facing they may be.

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions prior to 2.38.2 ZITADEL versions prior to 2.39.2 **Description** ZITADEL is an identity infrastructure management system where users can upload their own avatar image using various image types, including SVG. SVG can include scripts, such as javascript, which can be executed during rendering. Due to a missing security header, an attacker could inject code to an SVG to gain access to the victim’s account in certain scenarios. A victim would need to directly open the malicious image in the browser, where a single session in ZITADEL needs to be active for this exploit to work. If the possible victim had multiple or no active sessions in ZITADEL, the attack would not succeed. **Recommendations** For versions prior to 2.38.2, update to version 2.38.2 or later to resolve the issue. For versions prior to 2.39.2, update to version 2.39.2 or later to resolve the issue. As a temporary workaround, consider restricting the upload of SVG images or disabling the rendering of SVG images in the browser until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Piccolo versions 0.120.0 and prior **Description** The implementation of `BaseUser.login` in Piccolo leaks enough information to a malicious user, allowing them to generate a list of valid users on the platform. This list can be used in a password spray attack to attempt to take over user accounts on the platform. The impact of this issue is minor, as it requires chaining with other attack vectors to gain more than just a list of valid users. The likelihood of this issue is possible, as it requires minimal skills to exploit, especially given that the underlying login functionality for Piccolo-based sites is open source. **Recommendations** For Piccolo versions 0.120.0 and prior, update to version 0.121.0 to resolve the issue. As a temporary workaround, consider restricting access to the `BaseUser.login` function until a patch is available. Avoid using the `username` and `password` parameters in the affected API endpoint until the issue is resolved.