Euriconicacio

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was revoked.

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS DELETE instead of NEWS EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.

phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.

Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups roles export check in modules/groups-roles/lists show.php omits pdfl, which later runs the pdf export, letting users with list view rights download member lists as PDF files.

Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory data.php that allows authenticated users to bypass the inventory module enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names, even when the module is disabled.

**اسم البرنامج المصاب والإصدارات المتأثرة** undici الإصدارات 4.0.0 through 6.29.0 undici الإصدارات 7.0.0 through 7.30.0 undici الإصدارات 8.0.0 through 8.12.1 **Description** يقوم موزع Agent بإجراء عملية استنساخ عميق بناءً على JSON لخيارات المنشئ قبل توجيهها إلى مجموعات كل أصل. وبما أن JSON لا يمكنه تمثيل الدوال، فإن أي خيار `tls` يحتوي على استدعاء `checkServerIdentity` يتم إسقاطه بصمت. يؤدي ذلك إلى قبول طرف TLS إذا اجتاز فحوصات اسم المضيف والسلسلة الافتراضية، حتى لو تم كتابة `checkServerIdentity` مخصص لرفضه. يؤثر هذا الأمر على المسارات الافتراضية التي تستخدمها `request` و `fetch` و `setGlobalDispatcher` بالإضافة إلى المسارات المباشرة والمسارات التي لا تستخدم بروكسي في `EnvHttpProxyAgent`. التطبيقات التي تمرر خيارات `tls` ذات قيم دالية لمهام مثل تثبيت الشهادة أو المفتاح العام هي فقط المعرضة للخطر. **Recommendations** تحديث الإصدارات 4.0.0 through 6.29.0 إلى 6.29.1 أو أحدث. تحديث الإصدارات 7.0.0 through 7.30.0 إلى 7.30.1 أو أحدث. تحديث الإصدارات 8.0.0 through 8.12.1 إلى 8.12.2 أو أحدث. كحل مؤقت، قم بتمرير خيارات TLS عبر `connect` بدلاً من `tls` أو استخدم `requestTls` و `proxyTls` للوجهات التي تستخدم بروكسي.

**Name of the Vulnerable Software and Affected Versions** ip-address versions prior to 10.5.1 **Description** The `Address6.isLinkLocal()` method in `src/ipv6.ts` incorrectly recognizes only the `fe80::/64` range instead of the full `fe80::/10` IPv6 link-local range. This creates an inconsistency where the same address may be identified as link-local by `getType()` and `getScope()` but return `false` when checked via `isLinkLocal()`. An attacker can use an address within the `fe80::/10` range to bypass trust-boundary checks, such as filters designed to prevent Server-Side Request Forgery (SSRF). SSRF is an attack where a user-supplied address tricks a server into making requests to internal destinations that are otherwise inaccessible. A successful bypass allows a request to reach an on-link host, such as a neighboring machine or a router on the server's own network segment. **Recommendations** Update to version 10.5.1. As a temporary workaround, verify the link-local range by using the `isHostInSubnet()` function against the `fe80::/10` subnet instead of relying on the `isLinkLocal()` method.

**Name of the Vulnerable Software and Affected Versions** copyparty (affected versions not specified) **Description** The SFTP front end contains a volume restriction bypass that allows authenticated users to create, remove, and truncate arbitrary paths outside permitted volume boundaries. This occurs because the ` mkdir`, ` rmdir`, and ` chattr` handlers construct destination paths using `vfs.get()`, `vn.canonical()`, and `os.path.join()` without invoking the `chk ap` access check. Consequently, attackers can traverse symlinks to leave a volume's top directory and perform unauthorized file operations via SSH FXP SETSTAT operations on paths outside their authorized volumes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mako versions prior to 1.4.2 **Description** On Windows, the `TemplateLookup.get template()` function in `mako/lookup.py` resolves template URIs using `posixpath`, whereas `Template. init ()` in `mako/template.py` validates them using `os.path` (which utilizes `ntpath`). A URI starting with a drive designator allows `ntpath` to absorb traversal segments before the leading dot-dot check, enabling `posixpath` resolution to escape the configured template directory. This can lead to the disclosure of process-readable files on the same volume. Additionally, if a targeted file contains Mako template syntax, it may be parsed and executed as a template. This occurs when an application passes attacker-controlled template names or include paths, which can be delivered via query strings, form or JSON bodies, route parameters, or dynamic include expressions. **Recommendations** Update Mako to version 1.4.2.

**Name of the Vulnerable Software and Affected Versions** Argo Workflows versions 4.1.0 through 4.1.3 **Description** An authorization bypass exists in the `ListArchivedWorkflows` function. The issue occurs when the `metadata.namespace` field selector utilizes the NotEquals operator, causing a failure to apply cluster-scoped access reviews. Users with namespace-scoped list permissions can employ a negated namespace field selector to retrieve archived workflows from other namespaces, potentially exposing annotations, parameter values, and spec arguments. **Recommendations** Update Argo Workflows to a version later than 4.1.3.

**Name of the Vulnerable Software and Affected Versions** multer versions 2.2.0 through 2.3.0 **Description** multer is a Node.js middleware for handling multipart/form-data uploads. When a request using disk storage is aborted during the upload process, file writes that finish after the abort cleanup has executed are not deleted. This results in orphaned files remaining on the disk. A remote unauthenticated attacker can exploit this by repeatedly starting and aborting uploads to fill the disk space, leading to a denial of service. **Recommendations** Upgrade multer to version 2.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Mailpit (affected versions not specified) **Description** The `IsInternalIP` deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix. This allows server-side request forgery (SSRF), a technique where an attacker induces a server to make requests to an unintended location. Attackers can provide hostnames that resolve to these addresses within message content to access the link check API and proxy endpoint, enabling access to internal resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Heym versions prior to 0.0.98 **Description** Authenticated users can connect to internal services because the software fails to apply Server-Side Request Forgery (SSRF) egress guards to the WebSocket Send and WebSocket Trigger nodes. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Attackers can create workflow nodes with arbitrary URLs and headers to access internal services and read responses from the WebSocket Trigger node. **Recommendations** Update to version 0.0.98 or later.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Flyto2 Core الأقدم من 2.28.0 **الوصف** يتيح تجاوز آلية الحماية من تزوير الطلبات من جانب الخادم للمهاجمين الوصول إلى الخدمات الداخلية باستخدام عنوان IPv6 غير المحظور `::`، والذي يقوم النواة بتوجيهه إلى عنوان الارتجاع (loopback) بشكل مشابه لـ `0.0.0.0`. من خلال إرسال الطلبات أو تشغيل عمليات إعادة التوجيه 302، يمكن للمهاجمين تجاوز نطاق عناوين IP الخاصة وفحوصات أسماء المضيفين المحظورة داخل الدالة `is private ip()`. يؤثر هذا على الوحدات النمطية `http.get` و`http.request` و`http.batch`، مما يتيح الوصول إلى الخدمات المرتبطة بـ IPv6 loopback. **التوصيات** التحديث إلى الإصدار 2.28.0 أو أحدث.

**Name of the Vulnerable Software and Affected Versions** gitoxide gix-fs versions prior to 0.23.0 **Description** A path validation bypass exists in the worktree checkout mechanism. This issue allows attackers to escape the worktree directory through symlink manipulation. When a forced checkout is performed with `overwrite existing` enabled, an attacker can create malicious repository trees where symlink entries replace validated directories. This causes subsequent files to be written outside the worktree via the symlink, potentially leading to file manipulation or code execution. **Recommendations** Update gitoxide gix-fs to version 0.23.0 or later.