Michael Holmquist

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import module() and getattr().

An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication (2FA) indefinitely. By submitting a crafted POST request that omits the `two-factor-authentication` field, an attacker can skip nonce verification and trigger the `delete two fa meta()` function. This action resets the grace period anchor timestamp during every login cycle, which defers the mandatory 2FA enforcement.

Authenticated users can publish content into other tenants' namespaces because the system fails to authorize callers against the workspace in the bulk publish endpoint path. This allows attackers to write published views with controlled title, body, and metadata into victim workspaces, which can be used to deface public pages or host phishing content on trusted URLs.

An out-of-bounds write occurs in the `NC4 HDF5 inq attname()` function when processing HDF5 files. The issue arises because HDF5 attribute names are copied into a fixed 256-byte buffer without proper length validation. An attacker can use a specially crafted HDF5 file with oversized attribute names to overflow the destination buffer, leading to memory corruption and application crashes during the enumeration of attribute names.

ModelScope uses PyYAML's unsafe `yaml.Loader` to parse model configuration files. This allows arbitrary code execution through Python object construction tags, enabling attackers to craft malicious model repositories with poisoned configuration files that execute code when loaded by users.

The software fails to revoke refresh tokens when a user changes their password, which allows unauthorized parties to maintain account access. An attacker possessing a stolen refresh token can call the `RefreshToken` RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the security measure intended to terminate sessions upon a password change.

Authenticated users can retrieve group memberships of other users because the software fails to perform per-object authorization checks. By calling the 'GET /users/{id}/groups' API endpoint with arbitrary `id` values, an attacker can access group names, entity associations, and private notes across tenant boundaries.

An authorization flaw exists in the '/render jinja template' endpoint. Low-privileged users can render arbitrary Jinja templates by providing raw template strings. This allows attackers who possess print permissions on any document to execute arbitrary SELECT statements against unrelated tables, which can lead to the exposure of password hashes from the ` Auth` table.

An incorrect authorization check in the REST API allows authenticated users to delete documents using insufficient permissions. The `Documents::delete()` function in `htdocs/api/class/api documents.class.php` calls `dol check secure access document()` using the `read` mode instead of the `write` mode when processing the `DELETE /api/index.php/documents` endpoint. Consequently, a user with only read permissions for a module (such as `societe:lire` or `facture:lire`) can permanently delete files, including invoices, orders, proposals, project files, and generated PDFs, without having create, write, delete, or admin privileges.

The software saves inbound email attachments using the name provided in the message's MIME headers without properly sanitizing it to a safe basename. This occurs within the global `saveAttachment()` function in htdocs/emailcollector/lib/emailcollector.lib.php, which constructs `$filepath` using `$path`, `$filename`, and `$ext` before passing it to `file put contents()`, and the private `saveAttachment()` function in htdocs/emailcollector/class/emailcollector.class.php, which writes to `$destdir` using `$filename`. These values are derived from the attachment's `getName()` or `getFilename()` during record-join, create-ticket, and create-project operations. An attacker can include a traversal sequence in the filename to place controlled content outside the intended attachment directory without requiring an account. If the htdocs directory is read-only, the impact is limited to the documents tree, potentially corrupting or forging other objects' documents. However, if htdocs is writable, the attacker can write files to a web-executable path.

The software stores and renders workspace card descriptions without Cross-Site Scripting (XSS) filtering. This occurs because the description field of the Workspace Link doctype is configured to ignore XSS filters, causing the ` sanitize content()` function in `frappe/model/base document.py` to store the submitted value without sanitization. Subsequently, the `LinksWidget.set body()` function in `frappe/public/js/frappe/widgets/links widget.js` interpolates this content into a Bootstrap popover without HTML escaping. A user with the Workspace Manager role can inject arbitrary markup into a public workspace card description. This markup executes in the session of any user who hovers over the description, potentially allowing session token theft and unauthorized authenticated requests.

An out-of-bounds read and write occurs when the software subscripts its layer array using an index from a configuration file without verifying it against the array length. The array is allocated in `src-lib/darknet network.cpp` based on the number of layer sections declared. Specifically, the `from` field in shortcut, scale channels, and sam sections, and the `layers` field in the route section, provide indices that are used in `parse shortcut section` within `src-lib/darknet cfg.cpp` to read `net.layers[index].outputs` without bounds checking. Subsequently, the dispatch loop in `create network` uses the same index to assign values to `net.layers[l.index].use bin output` and `net.layers[l.index].keep delta gpu`, resulting in a write operation past the allocation. Processing a specially crafted configuration file can lead to a reliable system crash.

Baserow fails to act on the result of a permission check when dispatching an Application Builder data source. The dispatch and record-name views in `backend/src/baserow/contrib/builder/api/data sources/views.py` use a permission class that allows any caller, enabling unauthenticated requests to reach the handler. Subsequently, the `DataSourceService.dispatch data sources` function in `backend/src/baserow/contrib/builder/data sources/service.py` calls `check multiple permissions()` without requiring it to raise an exception and ignores the returned mapping of denials. Consequently, the data source is dispatched using the integration's own credentials regardless of the caller's identity, allowing unauthenticated users to retrieve rows and fields by enumerating small integer identifiers.

A SQL injection exists in the CSV and XLSX import wizard. The issue occurs because the wizard reads update keys using the `GETPOST('updatekeys','array')` function in `htdocs/imports/import.php`, applying only a filter that removes HTML while leaving SQL keywords, quotes, and parentheses intact. Subsequently, the `import insert()` function in `htdocs/core/modules/import/import csv.modules.php` builds a filter where the `$where[]` variable is constructed using the submitted keys without proper validation against a legitimate list of column codes. This allows a user with import permissions to use a `UNION SELECT` statement to exfiltrate arbitrary table content or redirect which row is overwritten during an update. The vulnerability is triggered when the assembled string is executed via `$this->db->query()`.

The software instantiates classes based on a configuration file without restricting which classes can be named. The `instantiate class` function in `vocos/pretrained.py` uses the `class path` value from the configuration to import a module via ` import ` and resolve an attribute using `getattr`, subsequently calling the result as `args class(*args, **kwargs)` with arguments from the `init args` mapping. Because there is no allowlist to constrain the dotted path, a configuration file can specify any importable callable and its arguments. This issue is reachable through `Vocos.from hparams` for `feature extractor`, `backbone`, and `head` entries, as well as through `Vocos.from pretrained`, which downloads a `config.yaml` from a specified Hugging Face repository. Consequently, loading a model from an untrusted repository allows the repository owner to execute arbitrary code during the loading process.

توجد مشكلة في قائمة السماح `security.http.urls` التي تُعد وسيلة التحكم الوحيدة لعمليات الاسترداد الصادرة التي تنفذها `resources.GetRemote`. تقوم الدالة `CheckAllowedHTTPURL` الموجودة في `config/security/securityConfig.go` بالتحقق من صحة نص عنوان URL ومضيفات IPv4 المعيارية، لكنها تفشل في تحليل أسماء المضيفين أو فحص عنوان الوجهة الفعلي الذي يتصل به عميل HTTP. بالإضافة إلى ذلك، يفتقر العميل الموجود في `resources/resource factories/create/create.go` إلى ربط وقت الاتصال (dial-time hook)، مما يعني عدم إجراء أي تحقق من الصحة خلال مرحلة الاتصال. ونتيجة لذلك، يمكن لاسم مضيف يُحل إلى عنوان loopback أو عنوان خاص أو عنوان بيانات تعريف سحابية أن يتجاوز السياسة. يمكن للمهاجم القادر على توفير عنوان URL عبر المحتوى، مثل حقل CMS أو حقل front-matter، أن يجبر عملية البناء على جلب البيانات من نقطة نهاية داخلية وتضمين الاستجابة في المخرجات الثابتة، مما يؤدي إلى تزوير الطلب من جانب الخادم (SSRF).

يفشل مُعالج fenced-code-block الافتراضي في إخفاء قيم السمات المستمدة من سلسلة معلومات code-fence عند كتابتها إلى HTML المعروض. يحدث هذا لأن الدالة `New` في `markup/internal/attributes/attributes.go` تحول قيم السمات من شرائح البايت إلى سلاسل، متجاوزةً عملية الإخفاء. وبالتالي، فإن الدالة `RenderAttributes()` لا تقوم بتحويل القيم التي تظل على شكل شرائح بايت فقط، مما يعني أن القيم النصية تُكتب حرفياً. يمكن للمهاجم استخدام علامة اقتباس داخل قيمة السمة لإنهاء السمة وحقن سمات إضافية، مثل معالجات الأحداث، في عنصر الغلاف، مما يؤدي إلى ثغرة «التنفيذ البرمجي عبر المواقع» (XSS) المخزنة. توجد هذه المشكلة في التكوين الافتراضي عند تمكين حواجز الكود (code fences)، بغض النظر عن الإعداد غير الآمن لـ goldmark أو خطافات العرض المخصصة. وعلى الرغم من تصفية أسماء السمات التي تبدأ بـ `on` أثناء التحليل، إلا أن الحقن لا يزال ممكنًا عبر قيمة السمة.

تفشل عملية إعادة توجيه الحافظة في نظام Windows في إجراء فحص الحد الأعلى عند نسخ طول مقدم من الطرف المقابل إلى مخزن مؤقت ثابت الحجم تابع للمستدعي. عندما يقوم مستهلك لصق OLE، مثل explorer.exe، باستدعاء `IStream::Read` باستخدام مخزن مؤقت بحجم `cb` بايت، تقوم الدالة `CliprdrStream Read` الموجودة في `libs/clipboard/src/windows/wf cliprdr.c` بطلب البيانات عبر `cliprdr send request filecontents` وتنفيذ `CopyMemory(pv, clipboard->req fdata, clipboard->req fsize)`. يتم أخذ المتغير `req fsize` مباشرةً من استجابة CLIPRDR FileContentsResponse الخاصة بالنظير عبر `wf cliprdr server file contents response` ولا يتم تقييده بقيمة `cb`. ونظرًا لأن مقارنة الطول `req fsize < cb` تحدث بعد عملية النسخ، يمكن لأحد الأقران الخبيثين إرسال استجابة كبيرة الحجم لكتابة بيانات عشوائية تتجاوز نهاية مخزن الذاكرة المؤقت (heap buffer) لمستهلك اللصق عندما يقوم مستخدم محلي بلصق محتويات ملف الحافظة من جهة بعيدة.

An issue exists in the `flair/models/clustering.py` file where the `ClusteringModel.load()` static method uses `pickle.loads()` on a file loaded via `joblib.load()`. This allows for the execution of arbitrary Python code when a maliciously crafted model file is loaded, granting the attacker the privileges of the process performing the load.