Joshua Martinelle

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات صورة Docker لـ Gitea الأقدم من 1.26.3 **الوصف** تحتوي صورة Docker الرسمية لـ Gitea على عيب في التكوين في القالب `app.ini` حيث يتم تعيين المتغير `REVERSE PROXY TRUSTED PROXIES` إلى `*` بشكل افتراضي. عند تمكين مصادقة الوكيل العكسي عبر الإعداد `ENABLE REVERSE PROXY AUTHENTICATION`، يثق التطبيق في رؤوس الهوية الواردة من أي عنوان IP مصدر بدلاً من قصرها على وكيل موثوق به. وهذا يسمح لمهاجم بعيد غير مصدق عليه بانتحال صفة أي مستخدم، بما في ذلك المسؤولين، عن طريق إرسال رأس `X-WEBAUTH-USER` مُصمم خصيصًا مباشرةً إلى منفذ HTTP الخاص بالحاوية. إذا تم تمكين التسجيل التلقائي، يمكن للمهاجم انتحال صفة أسماء مستخدمين عشوائية لا توجد بعد في النظام. لا تؤثر هذه المشكلة على واجهة برمجة التطبيقات (API) القائمة على الرموز المميزة (`/api/v1/...`). يوجد ما يقارب 22,900 مضيف Gitea فريد معرضًا للإنترنت، مع ما يقدر بـ 6,200 مثيل تم استهدافها بشكل خاص في محاولات الاستغلال المبكرة. وقد لوحظت أنشطة استطلاع فعلية باستخدام خدمات إخفاء الهوية للبحث عن المثيلات المعرضة للخطر. **التوصيات** قم بتحديث صور Docker الخاصة بـ Gitea إلى الإصدار 1.26.4 أو أحدث. اضبط المتغير `REVERSE PROXY TRUSTED PROXIES` على عناوين IP المحددة للوكلاء العكسيين الموثوق بهم بدلاً من استخدام حرف البدل. قم بتعطيل الإعداد `ENABLE REVERSE PROXY AUTHENTICATION` إذا لم تكن مصادقة الوكيل العكسي مطلوبة. قم بتعطيل التسجيل التلقائي للمستخدمين إذا لم يكن ضروريًّا

**Name of the Vulnerable Software and Affected Versions** Project Manager WordPress Plugin (affected versions not specified) **Description** The issue is an authenticated SQL injection vulnerability in the `orderby` parameter in the "/pm/v2/activites" API endpoint. This vulnerability affects the 'Project Manager' WordPress Plugin. **Recommendations** As a temporary workaround, consider disabling the `orderby` parameter in the "/pm/v2/activites" route until a patch is available. Restrict access to the "/pm/v2/activites" API endpoint to minimize the risk of exploitation. Avoid using the `orderby` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 2.1.1 Flowise Chat Embed versions prior to 2.0.0 **Description** The issue is related to a Stored Cross-Site vulnerability due to a lack of input sanitization. **Recommendations** For Flowise versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. For Flowise Chat Embed versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Flowise version 1.8.2 Description: An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise, leading to a complete crash of the instance running a vulnerable version due to improper handling of user-supplied input to the "/api/v1/get-upload-file" API endpoint. Recommendations: For Flowise version 1.8.2, as a temporary workaround, consider restricting access to the "/api/v1/get-upload-file" API endpoint until a patch is available. Additionally, avoid using this endpoint with untrusted user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DevikaAI versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards **Description** A stored cross site scripting issue exists due to improperly decoded user input. This allows for the storage and subsequent execution of malicious scripts, potentially leading to unauthorized actions on behalf of the user. **Recommendations** For versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards, consider implementing proper input decoding and validation to prevent the storage of malicious scripts. As a temporary workaround, restrict user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.0.13 **Description** The issue allows a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the "/api/v1/users" endpoint. **Recommendations** For Langflow versions prior to 1.0.13, update to version 1.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v1/users" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress RSS Aggregator versions prior to 4.23.9 **Description** The issue is related to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is caused by the lack of sanitization of the `notice id` GET parameter. **Recommendations** For versions prior to 4.23.9, update to version 4.23.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the `notice id` parameter in the affected endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Solidus versions prior to 4.3.5 **Description** The issue is related to a Stored Cross-Site Scripting vulnerability in the order tracking URL. **Recommendations** For versions prior to 4.3.5, update to version 4.3.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Appwrite versions prior to v1.4.14 **Description** The issue is related to a Server-Side Request Forgery (SSRF) that can be exploited via the "/v1/avatars/favicon" endpoint. This is due to an incomplete fix of a previously identified issue. **Recommendations** For versions prior to v1.4.14, update to version v1.4.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/v1/avatars/favicon" endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** HTML5 Video Player version < 2.5.25 **Description** The issue is an unauthenticated SQL injection vulnerability. It affects the `id` parameter in the `get view` function. **Recommendations** For version < 2.5.25, update to version 2.5.25 or later to resolve the issue. As a temporary workaround, consider restricting access to the `get view` function until a patch is available. Avoid using the `id` parameter in the affected function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** My Calendar WordPress Plugin version < 3.4.22 **Description** The issue is related to an unauthenticated SQL injection vulnerability. This vulnerability is present in the `from` and `to` parameters in the "/my-calendar/v1/events" rest route. It allows a remote attacker to execute arbitrary SQL queries to the database. **Recommendations** For My Calendar WordPress Plugin version < 3.4.22, update to version 3.4.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/my-calendar/v1/events" API endpoint until a patch is available. Avoid using the `from` and `to` parameters in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions <= 4.4.11 **Description** A post-authentication stored cross-site scripting issue exists, allowing HTML, including script tags, to be injected into field names. This injection triggers when users visit the Categories or Entries pages after the field is added to a category or section. **Recommendations** For Craft CMS versions <= 4.4.11, update to version 4.4.12 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Meta Data and Taxonomies Filter WordPress plugin versions prior to 1.3.1 **Description** The issue is a reflected cross-site scripting vulnerability in the `tax name` parameter of the mdf get tax options in widget action. This can only be triggered by an authenticated user. **Recommendations** For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mdf get tax options in widget action to minimize the risk of exploitation. Avoid using the `tax name` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Lead Generated WordPress Plugin version <= 1.23 **Description** The issue is related to an unauthenticated insecure deserialization problem. The `tve labels` parameter of the `tve api form submit` action is passed to the PHP `unserialize()` function without proper sanitization or verification. This could lead to PHP object injection, which, when combined with specific class implementations or gadget chains, and a POP chain, could be used to perform various malicious actions. **Recommendations** For The Lead Generated WordPress Plugin version <= 1.23, consider updating to a version that fixes this issue, as using the `unserialize()` function without proper input validation poses a significant risk. As a temporary workaround, consider restricting access to the `tve api form submit` action to minimize the risk of exploitation. Avoid using the `tve labels` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Formidable PRO2PDF WordPress Plugin versions prior to 3.11 **Description** The issue is an authenticated SQL injection vulnerability. It affects the `fieldmap` parameter in the `fpropdf export file` action. **Recommendations** For versions prior to 3.11, update to version 3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fpropdf export file` action to minimize the risk of exploitation. Avoid using the `fieldmap` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WP Popup Banners WordPress Plugin version <= 1.2.5 **Description** The issue is an authenticated SQL injection vulnerability. It affects the `value` parameter in the `get popup data` action. **Recommendations** For WP Popup Banners WordPress Plugin version <= 1.2.5, consider updating to a version greater than 1.2.5 to resolve the issue. As a temporary workaround, restrict access to the `get popup data` action to minimize the risk of exploitation. Avoid using the `value` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Events Made Easy WordPress Plugin version <= 2.3.14 **Description** The issue is an authenticated SQL injection vulnerability. It affects the `search name` parameter in the `eme recurrences list` action. **Recommendations** For Events Made Easy WordPress Plugin version <= 2.3.14, update to a version greater than 2.3.14 to resolve the issue. As a temporary workaround, consider restricting access to the `eme recurrences list` action to minimize the risk of exploitation. Avoid using the `search name` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** BuddyForms WordPress plugin versions prior to 2.7.8 **Description** The issue is related to an unauthenticated insecure deserialization problem. An attacker could exploit this to call files using a PHAR wrapper, which deserializes data and calls arbitrary PHP Objects. This can be used for malicious actions if a POP chain is also present. **Recommendations** For versions prior to 2.7.8, update to version 2.7.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's deserialization functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Login with Phone Number WordPress Plugin version < 1.4.2 **Description** The issue is related to an authenticated SQL injection vulnerability in the `lwp forgot password` action. Specifically, the vulnerability is associated with the lack of protection measures for the SQL query structure, which can be exploited by a remote attacker to execute arbitrary code. The `ID` parameter of the `lwp forgot password` action is vulnerable. **Recommendations** For Login with Phone Number WordPress Plugin version < 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `lwp forgot password` action until a patch is available. Avoid using the `ID` parameter in the affected action until the issue is resolved.