Yanchon918S

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.5 **Description** An issue exists that allows non-SuperAdmin administrators to escalate their privileges. A delegated administrator possessing USER ADD/EDIT/DELETE permissions can exploit the '/admin/api/user/add' endpoint by sending a POST request with the `isSuperAdmin` variable set to true and providing attacker-chosen credentials. This process enables the creation of a SuperAdmin account, allowing the attacker to authenticate as that user and achieve full instance takeover. **Recommendations** Update to version 4.1.5 or later. Restrict access to the '/admin/api/user/add' endpoint for users without necessary administrative privileges.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.5 **Description** An issue exists in the `updatePermissions` function within the `GroupController` that allows administrators with `GROUP EDIT` privileges to grant arbitrary rights to groups without verifying if they possess those rights themselves. A delegated administrator can exploit this by assigning high-value permissions to a group they are a member of, thereby inheriting those rights and escalating their privileges to full administrative control. **Recommendations** Update to version 4.1.5 or later. As a temporary mitigation, restrict the use of the `updatePermissions` function in the `GroupController` for delegated administrators.

**Name of the Vulnerable Software and Affected Versions** Sandboxie-Plus versions prior to 1.17.3 **Description** Several ProcessServer handlers, specifically `KillAllHandler()`, `SuspendAllHandler()`, and `RunSandboxedHandler()`, copy a `boxname` field from request structures into stack buffers using `wcscpy` without verifying null termination. Since the service pipe accepts variable-length packets larger than the request structure, a local attacker can fill the `boxname` field with non-zero data and append controlled wide characters to overflow the destination stack buffer. The service pipe is created with a NULL DACL (Discretionary Access Control List), which is a security descriptor that allows any local process to connect, and the unsafe copy occurs before authorization checks. This can result in a crash of the SbieSvc service or potential code execution with SYSTEM privileges. **Recommendations** Update to version 1.17.3.

**Name of the Vulnerable Software and Affected Versions** Sandboxie-Plus versions prior to 1.17.3 **Description** The `SbieIniServer::HashPassword()` function incorrectly converts a SHA-1 digest to hexadecimal by shifting the high nibble of each byte right by 8 instead of 4. This process results in the high nibble always being zero for an 8-bit value, meaning the stored `EditPassword` hash only preserves the low nibble of each digest byte. Consequently, the effective entropy is reduced from 160 bits to 80 bits. This flaw, combined with an unsalted SHA-1 scheme, makes leaked or backed-up password hashes significantly easier to brute-force. **Recommendations** Update to version 1.17.3.

**Name of the Vulnerable Software and Affected Versions** Sandboxie-Plus versions prior to 1.17.3 **Description** An issue exists in the `NamedPipeServer::OpenHandler` function where the server field from `NAMED PIPE OPEN REQ` is copied into a fixed `WCHAR pipename[160]` stack buffer using `wcscat` without verifying null termination. Because the service pipe accepts variable-length messages and only enforces a minimum packet size, a sandboxed caller can fill the `server[48]` field with non-zero data and append controlled wide characters. This causes `wcscat` to read past the fixed field and overflow the stack buffer in the SYSTEM service, creating a sandbox escape vector. This may result in a crash of the SbieSvc service or potential code execution with SYSTEM privileges. **Recommendations** Update to version 1.17.3.

**Name of the Vulnerable Software and Affected Versions** Sandboxie-Plus versions prior to 1.17.3 **Description** The SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The `MSGID SBIE INI RUN SBIE CTRL` message is processed before standard sandbox and impersonation checks. For callers not in a sandbox, the handler uses `memcpy()` to copy the trailing message payload into a fixed-size `ctrlCmd[128]` stack buffer without verifying if the length fits. Because the service pipe is created with a NULL DACL (Discretionary Access Control List), which is a security descriptor that allows any user access, any local interactive process can connect and send an oversized payload to overflow the stack. This may result in a crash of the SbieSvc service or potential code execution with SYSTEM privileges. **Recommendations** Update to version 1.17.3.

**Name of the Vulnerable Software and Affected Versions** Cryptomator versions prior to 1.19.1 **Description** Cryptomator encrypts data stored on cloud infrastructure. The Hub-based unlock flow, in versions before 1.19.1, allows the use of hub+http and retrieves Hub endpoints from vault metadata without requiring HTTPS. This can lead to OAuth and key-loading traffic being transmitted over insecure HTTP connections, potentially exposing bearer tokens and endpoint trust decisions to interception and tampering by a network attacker. The issue is related to the handling of Hub endpoints and the lack of HTTPS enforcement during the unlock process. **Recommendations** Update to version 1.19.1 or later.

**Name of the Vulnerable Software and Affected Versions** Cryptomator versions 1.6.0 through 1.19.0 **Description** Cryptomator encrypts data stored in cloud infrastructure. Versions prior to 1.19.1 parse vault configuration before verifying its integrity. The masterkeyfile loader utilizes the unverified key ID as a filesystem path, resolving `keyId.getSchemeSpecificPart()` against the vault path and checking for file existence using `Files.exists()`. This allows a malicious vault configuration to leverage parent directory escapes, absolute local paths, or UNC paths (e.g., `masterkeyfile://attacker/share/masterkey.cryptomator`). Specifically on Windows, the UNC variant can trigger outbound SMB access before passphrase entry due to path resolution. The vulnerable function is `Files.exists()`. The vulnerable parameter is `keyId`. **Recommendations** Update to version 1.19.1 or later.