Dilshod Gofurov

LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders.

**Name of the Vulnerable Software and Affected Versions** FusionPBX versions prior to 5.6.6 **Description** An OS command injection issue exists in the `call recordings::download()` function. Unauthenticated attackers can execute commands as the web server user by placing calls with malicious caller ID values. When the `record name` filename template is enabled, shell metacharacters such as `$(...)` can be embedded in the Caller-ID name or number. The execution occurs when a privileged user downloads multiple recordings as a ZIP file. **Recommendations** Update FusionPBX to version 5.6.6 or later. As a temporary mitigation, disable the `record name` filename template.

**Name of the Vulnerable Software and Affected Versions** MediaFlow Proxy versions prior to 2.5.0 **Description** An issue exists in the '/proxy' endpoint where missing and incomplete destination validation of the `d` query parameter allows for server-side request forgery (SSRF). This occurs when a server is tricked into making requests to an unintended location. Remote attackers can provide arbitrary internal URLs, such as loopback addresses or cloud metadata endpoints, to retrieve full responses from the proxy server. **Recommendations** Update to a version newer than 2.4.9. As a temporary mitigation, restrict access to the '/proxy' endpoint or validate the `d` parameter to prevent requests to internal network addresses.