Lichoin

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage options users. Attackers can call dt verify external connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt begin authorization to create connections.

Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including unpublished content, and reveal editorial activity timing.

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT USER administrators to perform write actions while impersonating the protected ROOT USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set meta() in includes/utils.php unserializes on the destination site, storing attacker-defined objects whose impact depends on loaded gadget classes.

**Name of the Vulnerable Software and Affected Versions** Adminer versions 6.0.0 through 6.0.1 **Description** Pre-authentication server-side request forgery occurs when the official ClickHouse driver plugin `plugins/drivers/clickhouse.php` is loaded. An unauthenticated attacker can provide `auth[driver]=clickhouse` and set the `auth[server]` variable to an arbitrary URL. This causes the server to send an HTTP POST request containing 'SELECT version()' to the specified host. Within the `rootQuery()` function, if the target returns an HTTP status code outside the 200-299 range (excluding 401 and 403), the raw HTTP response body is assigned to the connection error and displayed on the login page. This allows for internal network and port reconnaissance, as well as the disclosure of sensitive information such as stack traces, internal hostnames, file paths, and configuration identifiers found in internal error pages. **Recommendations** Update to version 6.0.2. As a temporary mitigation, avoid loading the `plugins/drivers/clickhouse.php` driver plugin.

**Name of the Vulnerable Software and Affected Versions** Adminer versions 4.16.0 through 6.0.1 **Description** A pre-authentication Server-Side Request Forgery (SSRF) exists in the optional Elasticsearch driver located at `plugins/drivers/elastic.php`. The issue occurs because `adminer/include/auth.inc.php` calls the `Driver::connect()` function before validating the login result. An unauthenticated attacker can send crafted `auth[server]`, `auth[username]`, and `auth[password]` parameters to force the server to issue an HTTP GET request via `get url()` or `file get contents()` to an arbitrary reachable host and port. The driver fails to block loopback, private, or link-local addresses, and while it rejects ports below 1024, it appends the default port 9200 if none is provided. This allows for internal network reconnaissance and service fingerprinting, as connection failures and specific JSON error fields from non-2xx responses are displayed on the login page. This requires the Elasticsearch driver to be explicitly deployed and the PHP `allow url fopen` setting to be enabled. **Recommendations** Update to version 6.0.2. Restrict the use of the `plugins/drivers/elastic.php` driver if it is not required. Disable the PHP `allow url fopen` setting to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi Registry versions 0.4.0 through 2.11.0 **Description** An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider uses these coordinates as filesystem path components without rejecting parent-directory names, and the path-containment check utilizes an unnormalized resolved path. This allows an authenticated user with permissions to write and delete bundles in a bucket to upload a NAR with a crafted manifest, enabling file system operations outside of the intended file persistence directory. **Recommendations** Update Apache NiFi Registry to version 2.12.0.

**Name of the Vulnerable Software and Affected Versions** Windows Hyper-V (affected versions not specified) **Description** The issue is related to a buffer overflow in memory, which can be exploited to elevate privileges. This can allow an attacker to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.