Santhreal

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and attachment listings of unpublished or ACL-restricted FAQs.

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.9.13-56 ImageMagick versions prior to 7.1.2-31 **Description** The CUT encoder lacks a security policy check, which allows configured security policies to be bypassed. An attacker can provide specially crafted input to be processed by the CUT encoder, potentially leading to an application crash or the leakage of sensitive data. **Recommendations** Update to version 6.9.13-56 or later. Update to version 7.1.2-31 or later.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** A server-side request forgery (SSRF) issue exists where attackers with permissions to register or modify OAuth 2.0 clients can force the server to fetch internal resources. This occurs through the use of an unvalidated `jwks uri` variable. By leveraging client-authentication and ID-token validation, unauthenticated fetches can be triggered to probe internal hosts, metadata endpoints, or local files, or to cause a denial of service by exhausting request threads. **Recommendations** Update to version 16.1.3 or later.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified `id token hint` to the '/oauth2/connect/endSession' endpoint. By specifying any realm client in a forged hint, attackers can redirect victims to any registered post-logout URI, which can be used to facilitate phishing attacks by leveraging the trust associated with the OpenAM host. **Recommendations** Update to version 16.1.3 or later. As a temporary mitigation, restrict access to the '/oauth2/connect/endSession' endpoint or avoid using the `id token hint` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** A cross-site scripting defect exists where the SAML message, relay state, and target URL are placed unencoded into the load-balancer cookie bounce auto-submit page. This issue is reachable when `cookieHashRedirectEnabled` is set, potentially allowing script execution in the OpenAM origin. However, an unrelated HTTP 500 failure prevents exploitation in released versions. **Recommendations** Update to version 16.1.3 or later. As a temporary mitigation, ensure the `cookieHashRedirectEnabled` setting is disabled.

**Name of the Vulnerable Software and Affected Versions** OpenAM versions prior to 16.1.3 **Description** An email content injection issue allows unauthenticated attackers to control the wording of notification emails. This is possible through the `forgotPassword` and `register` actions on the '/json/{realm}/users' endpoint. By supplying the `subject` and `message` fields, attackers can send phishing emails using the organization's configured From address or use the registration process as a relay to send emails to arbitrary recipients. **Recommendations** Update to version 16.1.3 or later. Restrict access to the '/json/{realm}/users' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** vllm versions prior to 0.29.0 **Description** The software fails to enforce the `VLLM MAX AUDIO CLIP FILESIZE MB` limit during multimodal chat audio decoding. This allows unauthenticated clients to bypass file size restrictions by submitting oversized audio files through chat endpoints, leading to excessive consumption of memory and CPU resources during the decoding process. **Recommendations** Update vllm to version 0.29.0 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-31 **Description** A policy bypass exists in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. An attacker can bypass resource policies by processing specially crafted UHDR images, which may lead to a denial of service due to excessive memory allocation. **Recommendations** Update to version 7.1.2-31 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-31 ImageMagick versions prior to 6.9.13-56 **Description** A division-by-zero flaw exists in the FLIF encoder. When processing an image with an incorrect value for ticks per second, the encoder crashes, leading to a denial of service. **Recommendations** Update to version 7.1.2-31 or later. Update to version 6.9.13-56 or later.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to c3edcc274c389816d434acadac07ee78eaf330c1 **Description** The software uses cryptographically weak `uniqid()` values for RTMP publish keys in LiveTransmition. This reduces key entropy to approximately one million possibilities per second of creation. An attacker with knowledge of the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner. **Recommendations** Update AVideo to a version later than c3edcc274c389816d434acadac07ee78eaf330c1.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** The software uses a cryptographically weak pseudo-random number generator to create account activation and login pairing codes. The `getRandomCode()` function in `objects/functions.php` derives codes from `uniqid()`, which uses seconds and microseconds, with a single `rand()` character for padding. This significantly reduces the possible code values for a known generation second. The endpoint 'plugin/API/set.json.php?APIName=login code' can be accessed without authentication and acts as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code can use the endpoint 'plugin/API/get.json.php?APIName=login code' to retrieve the target account's email address and a `User::getUserHash(users id, '+1 year')` value. This hash is accepted as a password for one year, allowing for full account takeover. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) **Description** Authenticated users can post comments on password-protected and group-restricted videos because the software fails to verify video access permissions in the `set api comment()` function. This allows attackers to submit POST requests to the comment API endpoint using arbitrary video IDs to write comments on videos they are not authorized to watch. **Recommendations** Update to a version later than 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1).

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) **Description** Logged-in users can vote on password-protected and group-restricted videos because the system fails to validate video access permissions in the API like endpoint. This allows attackers to increment vote counters on videos they are not authorized to watch by calling the 'set.json.php' endpoint using `APIName` parameters. **Recommendations** Update to a version later than 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1).

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** Authenticated users can bypass password and group access controls to post comments on restricted videos. This occurs because the software fails to validate video access permissions when processing requests to the 'commentAddNew.json.php' endpoint. An attacker with a valid session can submit POST requests to add comments to videos they are not authorized to watch. **Recommendations** Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'commentAddNew.json.php' endpoint to minimize the risk of unauthorized comment submission.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** Logged-in users can record likes on password-protected and group-restricted videos because the software fails to validate video access permissions in the 'like.json.php' endpoint. This allows attackers to submit like requests for videos they are not authorized to watch, resulting in the increment of like counters and a bypass of access controls. **Recommendations** Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'like.json.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** Authenticated attackers can increment view counts and watch-time on videos they are not permitted to access. This occurs because the software fails to validate video access permissions in the 'videoAddViewCount.json.php' endpoint before updating view statistics, allowing requests to be submitted with arbitrary video IDs. **Recommendations** Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. As a temporary workaround, restrict access to the 'videoAddViewCount.json.php' endpoint.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** The Bookmark plugin fails to validate user permissions, allowing unauthenticated attackers to read chapter names from password-protected videos. By querying the 'getBookmarks.json.php' endpoint with a video ID parameter, an attacker can retrieve sensitive chapter metadata without providing authentication or password verification. **Recommendations** Update to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. Restrict access to the 'getBookmarks.json.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** An information disclosure issue exists where the system fails to require authentication for the 'plugin/TopMenu/menus.json.php' endpoint. Unauthenticated attackers can send GET requests to this endpoint to retrieve all menu data, including inactive and admin-only menu names that are not intended for display in the public navbar. **Recommendations** Update WWBN AVideo to a version beyond commit c3edcc274c389816d434acadac07ee78eaf330c1. Restrict access to the 'plugin/TopMenu/menus.json.php' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 **Description** An authorization issue exists when adding videos to playlists. The application fails to validate watch permissions in the 'playListAddVideo.json.php' endpoint. Authenticated attackers can add password-protected videos that they are not authorized to view to playlists they own by providing the `video ID` and `playlist ID` parameters. **Recommendations** Update WWBN AVideo to a version released after commit c3edcc274c389816d434acadac07ee78eaf330c1. Restrict access to the 'playListAddVideo.json.php' endpoint to minimize the risk of exploitation.