Vulncheck

**Name of the Vulnerable Software and Affected Versions** Cisco Jabber for Android versions prior to 15.3.1.311364 **Description** A path traversal issue exists where a malicious application can write files into the private data directory of the software. This is achieved by exploiting the exported `crosslaunch.share` activity and an unsanitized display name retrieved from a ContentProvider used during file path construction. An attacker can use a shared `content://` URI containing `../` sequences in the display name to place controlled content into directories including `databases/`, `shared prefs/`, `no backup/`, and `files/` without requiring user interaction. **Recommendations** Update Cisco Jabber for Android to version 15.3.1.311364 or later.

**Name of the Vulnerable Software and Affected Versions** libexpat versions prior to 2.9.0 **Description** A heap buffer over-read exists in the `xmlparse.c` file. The `XML ParseBuffer()` function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer size. Repeated calls to `XML ParseBuffer()` can move the `m bufferEnd` variable past the end of the heap allocation, causing subsequent parsing to read out of bounds. This path is reachable if a parse buffer is already present, which occurs after a call to `XML GetBuffer()` or an internal allocation via `XML Parse()`. This issue allows the disclosure of adjacent heap memory, which can leak heap pointers, libc function pointers, and code pointers, potentially defeating Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to make exploitation harder. **Recommendations** Update libexpat to version 2.9.0. As a temporary mitigation, restrict the use of the `XML ParseBuffer()` function with attacker-influenced or oversized lengths.

**Name of the Vulnerable Software and Affected Versions** Crayons plugin for SPIP versions prior to 3.5.0 **Description** A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the `secu ` anti-forgery parameter is omitted in the 'crayons store.php' endpoint, causing the authorization dispatcher to resolve an unconditionally-true handler instead of performing the proper modification check. This flaw can be chained to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, resulting in arbitrary PHP code execution as the web-server user. **Recommendations** Update the Crayons plugin for SPIP to version 3.5.0 or later.

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.

**Name of the Vulnerable Software and Affected Versions** NetBox versions 2.9.5 through 4.6.x **Description** A server-side template injection occurs because the raw Django HttpRequest object is exposed to the Jinja2 template context. A low-privileged user with the "Can add custom links" permission can exploit this by crafting a custom link template that embeds `request.COOKIES['sessionid']` or an API token into an img src URL. This technique bypasses the `clean html` sanitizer, allowing the automatic exfiltration of a privileged user's session cookies and API tokens to an external host when the object is viewed, which can lead to full account takeover. **Recommendations** Update NetBox to version 4.7.0 or later. Restrict the "Can add custom links" permission to trusted users only.

**Name of the Vulnerable Software and Affected Versions** FacturaScripts versions prior to 2026.7 **Description** An authenticated attacker can exploit a PHP object injection issue within the `processFormData()` function of `WidgetSelect`. This occurs because the application performs `unserialize()` on raw POST data for multiple-select fields without applying an `allowed classes` filter. By submitting a serialized `XLSXWriter` object as a field value, an attacker can trigger the ` destruct()` method to delete arbitrary files, such as `config.php` or backup data. This can lead to a denial of service or a potential application reinstall hijack. **Recommendations** Update FacturaScripts to version 2026.7 or later.

**Name of the Vulnerable Software and Affected Versions** Camunda versions 7.24.0 through 7.24.14 **Description** An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The `SetupResource` incorrectly determines if the setup process is available by counting only direct members of the `camunda-admin` group instead of recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to access the setup user-create endpoint and create a new administrator account if the `camunda-admin` group is empty, even if the system is already fully administered. This can lead to account takeover, unauthorized process deployment, or script execution as the engine's service user. **Recommendations** Update Camunda to version 7.24.15.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An authenticated attacker can trigger a server-side request forgery (SSRF) by providing a malicious metadata URL to the `POST/PUT /api/identity-providers` endpoint. This occurs because the `IdentityProviderService.validateMetadataUrl()` function fails to validate the target host, IP, or scheme. This flaw allows the server to send requests to arbitrary internal or cloud metadata hosts, enabling internal network port scanning and unauthorized access to cloud instance-metadata services. **Recommendations** Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the `/api/identity-providers` endpoint.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An issue exists in the `searchQueryBuilder()` function of `UtmAssetGroupService` where authenticated attackers can inject arbitrary SQL. This occurs because the `assetType` and `groupName` variables are inserted unsanitized into a native PostgreSQL query using `String.format()`. Exploitation of the GET '/api/utm-asset-groups/searchGroupsByFilter' endpoint allows the execution of arbitrary SQL with DBA privileges, which can lead to full database read, data modification, and potential filesystem access. **Recommendations** Update UTMStack to version 11.2.16 or later. Avoid using the `assetType` and `groupName` variables in the '/api/utm-asset-groups/searchGroupsByFilter' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Phproject versions prior to 1.8.7 **Description** An issue exists in the REST API where object-level authorization is missing. Authenticated users with a valid API key can bypass the `security.restrict access` confidentiality control because the `allowAccess()` authorization routine is not invoked. This allows attackers to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to via the following endpoints: 'single get', 'single comments', and 'single comments post'. **Recommendations** Update Phproject to version 1.8.7 or later.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** Authenticated attackers can read arbitrary entity data by exploiting a JPQL injection issue. The vulnerability exists in the `UtmNetworkScanService.searchPropertyValues()` function, which constructs a JPQL query using `String.format()` and executes it via `em.createQuery()` without proper parameter binding. By sending malicious JPQL through the `value` parameter in the 'GET /api/utm-network-scans/searchPropertyValues' endpoint, attackers can extract sensitive information, including credential tables such as `jhi user`. JPQL (Java Persistence Query Language) is an object-oriented query language used to perform database operations on entities. **Recommendations** Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the 'GET /api/utm-network-scans/searchPropertyValues' endpoint or avoid using the `value` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** Authenticated attackers can perform a server-side request forgery (SSRF), a flaw where the server is tricked into making requests to an unintended location. By providing an unvalidated `url` parameter to the `downloadPdf()` function within the `PdfService`, exposed via the GET '/api/generate-pdf-report' endpoint, attackers can force the web-pdf microservice to access internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service. This allows sensitive internal data to be retrieved and rendered into the resulting PDF file. **Recommendations** Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the '/api/generate-pdf-report' endpoint or avoid using the `url` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint, attackers can distinguish between registered and unregistered accounts based on the HTTP response. Registered accounts return a 200 OK response, while unregistered accounts trigger a 500 Internal Server Error containing backend details. This information can be used to facilitate targeted phishing or credential attacks. **Recommendations** Update to version 11.2.16 or later.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An authorization flaw exists in the `UTMIncidentCommandWebsocket.processCommand()` function, which handles the '/command/{hostname}' STOMP destination. The system fails to perform role checks or apply a command allowlist before forwarding instructions. Consequently, any authenticated user can send arbitrary operating-system commands via gRPC to any connected agent, leading to command execution on monitored endpoints where agent processes typically operate with root or SYSTEM privileges. **Recommendations** Update to version 11.2.16. Rotate the `INTERNAL KEY`.

**Name of the Vulnerable Software and Affected Versions** UTMStack versions prior to 11.2.16 **Description** An authentication bypass exists that allows remote attackers to obtain full administrative API access. This occurs because the `InternalApiKeyFilter` accepts a valid `Utm-Internal-Key` header matching the `INTERNAL KEY` environment variable for any endpoint. The implementation lacks path restrictions, constant-time comparison, rate limiting, and audit logging. Attackers possessing this key can bypass user account requirements or JSON Web Tokens (JWT) to create accounts, manage users, exfiltrate data, and modify security rules. **Recommendations** Update UTMStack to version 11.2.16 or later.

**Name of the Vulnerable Software and Affected Versions** PictShare versions prior to 3.7.1 **Description** The software contains a weak randomness issue where the `getRandomString()` function utilizes the non-cryptographic `rand()` Pseudo-Random Number Generator (PRNG) to create the `delete code` authorization token within the `src/inc/core.php` file. This allows attackers to predict or infer the PRNG state to guess valid `delete code` values, enabling the unauthorized deletion of hosted files without requiring access to the info endpoint. **Recommendations** Update to version 3.7.1 or later. As a temporary mitigation, restrict access to the `getRandomString()` function or the file deletion functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** PictShare versions prior to 3.7.1 **Description** An information disclosure issue exists where unauthenticated attackers can obtain the secret `delete code` and uploader metadata. This occurs when calling the 'API::info()' endpoint, which returns the complete raw metadata object without a field whitelist. By using a publicly visible file hash, an attacker can retrieve the `delete code` and subsequently use the delete API to permanently remove arbitrary files. Additionally, this exposes the uploader IP, User Agent, remote port, and SHA-1 hash, compromising content integrity, availability, and uploader privacy. **Recommendations** Update PictShare to version 3.7.1 or later. Restrict access to the 'API::info()' endpoint to minimize the risk of metadata exposure.

**Name of the Vulnerable Software and Affected Versions** BlueALSA (affected versions not specified) **Description** A division-by-zero issue exists in the LC3plus sink decoder within the `a2dp lc3plus dec thread()` function located in `a2dp-lc3plus.c`. A Bluetooth-adjacent attacker can cause a denial of service by establishing an A2DP source connection and sending a crafted RTP media header where the frame count field is set to zero. This triggers a SIGFPE (floating-point exception), which crashes the daemon on builds compiled with LC3plus support enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iperf3 versions prior to 3.22 **Description** A denial of service issue allows unauthenticated remote attackers to cause the server's UDP receive worker to enter an unrecoverable infinite loop. This is achieved by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. The attack can pin the affected per-stream receive thread at approximately 100% CPU usage, making the server unusable until the process is forcibly terminated with SIGKILL, as it fails to respond to normal control-channel closure. **Recommendations** Update to version 3.22 or later.

**Name of the Vulnerable Software and Affected Versions** Dockhand versions prior to 1.0.36 **Description** An open redirect exists in the OIDC initiation endpoint. Unauthenticated remote attackers can redirect authenticated users to external sites by injecting an unvalidated redirect query parameter. This allows attackers to craft malicious links targeting the OIDC callback flow to capture authorization codes through the Referer header, potentially leading to credential phishing against Dockhand accounts following a legitimate login. **Recommendations** Update to version 1.0.36 or later.