Sondt99

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to execute code in users' browsers and hijack sessions.

**Name of the Vulnerable Software and Affected Versions** 9Router versions prior to 0.4.72 **Description** A server-side request forgery (SSRF) issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled `url` parameter and passes it to an external scraping provider to fetch content. Because the URL is only validated for syntax and lacks a blocklist for private IP ranges, link-local addresses, internal hostnames, or cloud metadata endpoints (such as 169.254.169.254), an authenticated or locally-connected user can force the server to fetch arbitrary internal URLs. This allows read-access SSRF, which can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints. **Recommendations** Update to version 0.4.72 or later. As a temporary workaround, restrict access to the '/v1/web/fetch' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 3.2.0 **Description** Custom API routes fail to validate namespace and database scope, which allows authenticated users to invoke endpoints across different namespaces or databases. An attacker with valid credentials for any namespace or database can access custom API endpoints belonging to other tenants by specifying the target scope within the URL path. This can lead to the unauthorized reading of sensitive data or the triggering of unintended operations. **Recommendations** Update SurrealDB to version 3.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 3.2.0 **Description** A denial of service issue exists in the SurrealML header parser. Authenticated users with the Owner role can crash the server by uploading a malformed .surml file to the '/ml/import' endpoint. By providing non-numeric `input-dimensions` or other malformed header fields, attackers can trigger unchecked unwrap calls, leading to a panic that aborts the server process and denies service to all databases. **Recommendations** Update SurrealDB to version 3.2.0 or later. Restrict access to the '/ml/import' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 3.2.0 **Description** A permissions bypass exists where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers who have permission to perform a guarded operation can write to tables for which they lack authorization by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, leading to unintended writes and data corruption. **Recommendations** Update to version 3.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** An authenticated user capable of creating or modifying chart definitions, or submitting chart data requests containing quota filters, can inject SQL into queries executed against configured datasources. This occurs because chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL within the `getYWheres()` function of `Quota2SQLObj` without applying the necessary SQL literal validation and escaping used by other filter paths. **Recommendations** Update to version 2.10.24.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** Dashboard text components render stored content using Vue `v-html` without server-side HTML sanitization. This allows an authenticated user with permissions to edit dashboard component data to inject HTML containing executable event handlers. These handlers execute when another user or a visitor using a shared link views the affected dashboard. **Recommendations** Update to version 2.10.24.

**Name of the Vulnerable Software and Affected Versions** Fiber versions prior to 3.4.0 **Description** The `helmet` middleware in the Fiber web framework fails to set the `Strict-Transport-Security` (HSTS) response header, even when `HSTSMaxAge` is configured. This occurs because the logic in `middleware/helmet/helmet.go` incorrectly uses the `c.Protocol()` function to check for HTTPS connections. The `c.Protocol()` function returns the HTTP protocol version (such as `HTTP/1.1` or `HTTP/2.0`) rather than the URL scheme. Consequently, the condition `c.Protocol() == "https"` always evaluates to false, rendering the HSTS protection inactive. This can leave users susceptible to SSL stripping attacks, protocol downgrades, and cookie theft over HTTP. **Recommendations** Update Fiber to version 3.4.0. As a temporary workaround, restrict the use of the `helmet` middleware if HSTS is the only required security header until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-24 **Description** An incorrect policy check allows remote attackers to bypass path policy restrictions in sandboxed conversion services. This flaw enables the creation or truncation of files that are disallowed by security policies, allowing arbitrary files to be written outside of intended boundaries. **Recommendations** Update to version 7.1.2-24 or later.

**Name of the Vulnerable Software and Affected Versions** @tinacms/app versions prior to 2.5.6 tinacms versions prior to 3.9.3 **Description** Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer—that process `event.data` without verifying `event.origin` or `event.source`. Additionally, it posts messages using non-specific target origins. A malicious page visited by a victim, or a window in an opener/iframe relationship with a Tina admin, can forge messages to control the editor, inject preview content, or manipulate the OAuth popup channel to hijack an authenticated editing session. **Recommendations** Update @tinacms/app to version 2.5.6. Update tinacms to version 3.9.3.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.13.3 **Description** A flaw in the library allows a maliciously crafted PDF to cause a Denial of Service (DoS). This occurs when the system parses a content stream that lacks a `/Length` value, causing the `MAX DECLARED STREAM LENGTH` limit to be ignored and resulting in excessive memory consumption. **Recommendations** Update to version 6.13.3.

**Name of the Vulnerable Software and Affected Versions** Runtipi versions 4.9.1 through 4.9.3 **Description** Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint. A path guard only checks the lexical path before Node reads the file, allowing a Git app store containing `metadata/logo.jpg` as a symbolic link to cause the system to read and return the symlink target. Since the endpoint is public and the target may point outside the cloned repository, this can expose local files from the Runtipi container, such as `/data/.env`, `/data/state/seed`, logs, or application files. This may lead to the disclosure of JWT (JSON Web Token) secrets, service credentials, local configuration, and operational logs. **Recommendations** Update to version 4.10.0.

**Name of the Vulnerable Software and Affected Versions** protobufjs versions 8.2.0 through 8.4.2 **Description** protobufjs preserves unknown wire elements in `message.$unknowns` during binary decode but lacks a decode-time option to discard these fields before retention. A crafted protobuf payload containing numerous unknown fields can cause a decoded message to consume significantly more memory than the original input size. This can increase memory pressure, degrade availability, or lead to process termination in services that decode and retain attacker-controlled messages. **Recommendations** For versions 8.2.0 through 8.4.2, update to version 8.5.0 or newer and disable unknown-field preservation by creating a `Reader` and setting `reader.discardUnknown = true`, or set `Reader.discardUnknown = true` as the default for subsequent readers. Update to version 8.6.2 or newer to have unknown fields discarded by default. Enforce input-size, request concurrency, and request timeout limits at the transport or application boundary.

**Name of the Vulnerable Software and Affected Versions** glances (affected versions not specified) **Description** The `secure popen()` function in `glances/secure.py` improperly interprets shell-like operators, specifically `>` (file redirection), `|` (pipe), and `&&` (command chaining), within command strings. When Application Monitoring Process (AMP) modules load `command` or `service cmd` configuration values from `glances.conf`, these values are passed to `secure popen()` without sanitization. This allows an attacker who can modify the configuration file to write arbitrary content to any filesystem path, chain arbitrary commands, or pipe output to other programs. Technical details include: - **Vulnerable Function**: `secure popen()` parses the `>` operator to write to files via `open(stdout redirect, "w")` without path validation, and uses `|` and `&&` to execute sequential or piped processes. - **Vulnerable Parameters**: The `command` and `service cmd` configuration values loaded from `[amp <name>]` and `[amp systemv]` sections. The `--disable-config-exec` flag does not mitigate this issue as it only prevents backtick execution in `config.get value()` and does not affect how `secure popen()` processes the resulting strings. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `glances.conf` file to prevent unauthorized modification of AMP `command` and `service cmd` values. Avoid using the `>` , `|` , and `&&` operators within the AMP configuration values.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.12.0 **Description** A flaw in the pure-python PDF library allows an attacker to craft a PDF file that causes long runtimes. This is achieved by using cross-reference streams with `/W [0 0 0]` values and large `/Size` values. **Recommendations** Update to version 6.12.0.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.12.0 **Description** A flaw in the pure-python PDF library allows an attacker to craft a PDF file that causes excessive memory consumption. This occurs when extracting text in layout mode using large character offsets. **Recommendations** Update to version 6.12.0.