Pavelkohout396

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted custom fields permission check.

Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (AppLivewireImporter, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file path, filesize, import type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header row column headers and first row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.

**Nome do Software Vulnerável e Versões Afetadas** phpMyFAQ versões anteriores a 4.1.8 **Description** Um problema de cross-site scripting armazenado existe onde a função `convertOldInternalLinks()` em `FaqHelper` chama `html entity decode()` em conteúdo de FAQ sanitizado. Este processo reverte a proteção de codificação de entidades, permitindo que usuários autenticados com privilégios de edição de FAQ injetem payloads de JavaScript. Esses payloads são executados nos navegadores de todos os usuários que visualizam as páginas de FAQ afetadas. **Recommendations** Atualize para a versão 4.1.8 ou posterior. Como mitigação temporária, restrinja os privilégios de edição de FAQ apenas a usuários altamente confiáveis.

**Nome do Software Vulnerável e Versões Afetadas** phpMyFAQ versões anteriores a 4.1.8 **Description** Existe uma falha de bypass de autorização no processo de criação de perguntas. A função `isAddingQuestionsAllowed()` concede acesso a todos os usuários quando a configuração `main.enableAskQuestions` está ativa, ignorando a configuração `records.allowQuestionsForGuests`. Isso permite que usuários não autenticados enviem perguntas através do endpoint de API 'question/create', ignorando as restrições para convidados para injetar spam na fila de moderação do administrador. **Recommendations** Atualize para a versão 4.1.8 ou posterior. Como medida de mitigação temporária, desative a configuração `main.enableAskQuestions` para evitar o envio de perguntas não autorizadas.

**Nome do Software Vulnerável e Versões Afetadas** phpMyFAQ versões 3.1.0 até 4.1.6 **Descrição** Existe uma falha de bypass de autenticação na função `AuthLdap::create()`. Quando a autenticação LDAP está habilitada, um bind LDAP bem-sucedido aciona a função `User::setStatus('active')` incondicionalmente. Esta ação sobrescreve a coluna `account status` de uma conta local existente, alterando-a de 'blocked' para 'active'. Consequentemente, usuários com contas locais administrativamente bloqueadas podem restaurar o acesso e fazer login via LDAP. Esta transição de estado não é registrada nos logs, impedindo que os administradores detectem a anulação do bloqueio. **Recomendações** Atualize o phpMyFAQ para a versão 4.1.7.

**Nome do Software Vulnerável e Versões Afetadas** phpMyFAQ versões anteriores a 4.1.7 **Description** Existe uma falha de bypass de autenticação de dois fatores (2FA) porque os tokens remember-me são emitidos antes da conclusão do processo de verificação 2FA. Um invasor com credenciais válidas pode obter um cookie remember-me para pular o desafio 2FA e reproduzir esse cookie para obter acesso autenticado total ao sistema sem fornecer a verificação de segundo fator. **Recommendations** Atualize para a versão 4.1.7 ou posterior.

**Nome do Software Vulnerável e Versões Afetadas** Mautic versões 7.0.0 through 7.1.1 **Description** Existe uma falha de bypass de autorização nos endpoints da API v2 (utilizando API Platform). Funções configuradas com restrições de escopo de proprietário, como `viewown` ou `editown`, não são aplicadas corretamente. Isso permite que usuários autenticados da API com baixos privilégios ignorem os controles de lógica de propriedade para acessar ou modificar recursos de outros usuários, incluindo relatórios, contatos e empresas, ignorando as fronteiras estruturais de locatário e privilégios. **Recommendations** Atualize para a versão 7.1.2. Revogue temporariamente as credenciais da API ou restrinja as permissões de acesso para usuários cujas funções dependam do contenimento de permissão de escopo de proprietário.

**Nome do Software Vulnerável e Versões Afetadas** Mautic versões anteriores a 7.1.2 **Descrição** Um problema de Cross-Site Scripting (XSS) armazenado existe no componente de seleção de projetos. A aplicação falha ao sanitizar nomes de projetos retornados via AJAX antes de injetá-los no Document Object Model (DOM) como campos de opção. Um usuário autenticado com permissões de criação de projetos pode armazenar um payload de script malicioso no nome de um projeto. Quando um usuário administrativo abre um editor de entidade contendo o seletor de projetos, o script é executado em sua sessão de navegador, podendo levar ao sequestro de sessão, coordenação de estado não autorizada ou acesso não autorizado a dados organizacionais. **Recomendações** Atualize para a versão 7.1.2. Restrinja as permissões de criação e modificação de projetos a usuários administrativos confiáveis.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the patient portal payment flow. This allows a patient portal user to inject arbitrary JavaScript code that will be executed in the browser of a staff member reviewing the payment submission. The malicious payload is stored in `portal/lib/paylib.php` and rendered without proper sanitization in `portal/portal payment.php`. **Recommendations** Update OpenEMR to version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is an electronic health records and medical practice management application. A DOM-based stored cross-site scripting issue exists in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`). An authenticated user with encounter form write access can inject arbitrary JavaScript that executes in another clinician's browser session when using the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. **Recommendations** Update to OpenEMR version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. The application is susceptible to a stored cross-site scripting (XSS) issue. This occurs due to unescaped `portal login username` within the portal credential print view. A patient portal user can inject an XSS payload as their login username, which then executes in a clinic staff member's browser when the "Create Portal Login" page is accessed for that patient. This allows for a transition from the patient session context to the staff/admin session context. **Recommendations** Versions prior to 8.0.0.2 should be updated to version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authenticated, non-administrator user can view reminder messages belonging to other users. This is achieved by manipulating the `sentTo[]` or `sentBy[]` parameters in a GET request to the dated reminders log. The issue allows access to patient names and the content of free-text messages. **Recommendations** Update to OpenEMR version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows authenticated users to invoke controller methods, including `getNotificationLog()`, without proper access control checks. The `AppDispatch` constructor bypasses ACL enforcement, potentially exposing patient appointment data (PHI). **Recommendations** Update to OpenEMR version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. The Claim File Tracker feature exposes an AJAX endpoint that returns billing claim metadata, including claim IDs, payer information, and transmission logs. This endpoint does not enforce the same Access Control List (ACL) as the main billing/claims workflow, allowing authenticated users without appropriate billing permissions to access sensitive data. The vulnerable API endpoint is an AJAX endpoint used by the Claim File Tracker feature. The issue arises because the endpoint does not properly validate user permissions before returning billing claim metadata. The vulnerable parameter is not explicitly mentioned. **Recommendations** Update OpenEMR to version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0.1, sensitivity checks for group encounters were not functioning correctly. The code was only checking the `form encounter` table for sensitivity information, while group encounters actually store this information in the `form groups encounter` table. This resulted in sensitivity restrictions not being applied to group encounters, potentially allowing unauthorized users to view sensitive information, such as mental health records. **Recommendations** Upgrade to OpenEMR version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the prescription CSS/HTML print view via patient demographics. This involves server-side rendering of patient names using a raw PHP echo and client-side DOM-based rendering via jQuery .html() in a separate component (`portal/sign/assets/signer api.js`). The root cause is unsanitized patient names in `patient data`. The issue has different sinks, affected components, and trigger actions, requiring independent fixes. **Recommendations** Versions prior to 8.0.0.1 should be updated to version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the Graphical Pain Map ("clickmap") form. This allows any authenticated clinician to inject arbitrary JavaScript that executes in the browser of every subsequent user who views the affected encounter form. Because session cookies are not marked HttpOnly, this enables full session hijacking of other users, including administrators. The `clickmap` form is the point of injection for the malicious script. The vulnerability affects the session cookies, allowing for unauthorized access. **Recommendations** Update OpenEMR to version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. An incorrect boolean condition within the `ControllerRouter::route()` function results in the administrator/super user access control check being applied only to specific controllers (review, log). This leaves other controllers – alerts, ajax, edit, add, detail, browse – accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts, delete or modify clinical plans, and edit rule configurations, operations that should require administrator privileges. **Recommendations** Versions prior to 8.0.0.1 should be updated to version 8.0.0.1 or later.