Itz-D0Dgy

An arbitrary file read issue allows authenticated attackers to access arbitrary files as root on the underlying Operating System by placing a crafted file into a readable directory. This poses a serious security risk, enabling attackers to read sensitive files on systems running Adguard Home.

The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI, this malicious SVG file could interact with the browser's LocalStorage and retrieve an AccessToken, which in turn can be used in an API call to elevate the target user to a Jellyfin administrator. The actual attack vector is unlikely to be exploited, as it requires specific actions by the administrator to view the SVG image outside of Jellyfin's WebUI.

A Stored Cross Site Scripting issue allows a remote attacker to escalate privileges via the notifications.html component.

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks.

ZITADEL provides identity infrastructure, allowing administrators to define a `Lockout Policy` with a maximum amount of failed password check attempts. In the affected implementation, an attacker could start multiple parallel password checks, attempting more combinations than configured in the `Lockout Policy`. This allowed the attacker to exceed the lockout limit, potentially leading to unauthorized access.