Akıner Kısa

**Name of the Vulnerable Software and Affected Versions** Ollama versions 0.14.0 through 0.31.1 **Description** An incorrect authorization issue exists in the experimental agent mode Bash tool approval mechanism due to improper parsing of shell syntax. Attackers capable of influencing model output via prompt injection can bypass session approval requirements to execute unauthorized shell commands. This is achieved by appending control operators, such as semicolons or logical operators, to commands that have been approved. **Recommendations** Update Ollama to version 0.31.2 or later.

**Name of the Vulnerable Software and Affected Versions** Kilo Code versions prior to 7.4.1 **Description** A local attacker can execute arbitrary code through the 'permission/allow-everything' endpoint. **Recommendations** Update to version 7.4.1 or later. As a temporary workaround, restrict access to the 'permission/allow-everything' endpoint.

**Name of the Vulnerable Software and Affected Versions** Bludit CMS versions prior to 3.22.1 **Description** Authenticated users with the Author role can modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. This occurs because the `Pages::edit()` function in bl-kernel/pages.class.php iterates through all fields declared in `dbFields` without performing per-field authorization. An attacker can submit reserved fields such as `type` and `username` to convert pages into static site-wide navigation entries or transfer page ownership to arbitrary accounts. Mass assignment is a vulnerability where an application takes user-provided data and binds it to an internal object without proper filtering, allowing the modification of restricted properties. **Recommendations** Update Bludit CMS to version 3.22.1 or later. As a temporary mitigation, restrict the permissions of users with the Author role to prevent unauthorized content save requests.

**Name of the Vulnerable Software and Affected Versions** Bludit CMS versions prior to 3.22.1 **Description** Authenticated users with the Author or Editor role can access the full content of private drafts and scheduled posts from any other user, including administrators. This occurs via the `content-get-list` AJAX endpoint located at `bl-kernel/ajax/content-get-list.php`. By sending an authenticated GET request to this endpoint with the `draft` parameter set to true, the `getList()` function is triggered without ownership constraints. This results in the return of serialized page objects from across the site, exposing sensitive notes and pre-publication material. **Recommendations** Update Bludit CMS to version 3.22.1 or later. As a temporary mitigation, restrict access to the `bl-kernel/ajax/content-get-list.php` endpoint for users with Author or Editor roles.

**Name of the Vulnerable Software and Affected Versions** Bludit CMS versions prior to 3.22.1 **Description** An authorization bypass allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators. This occurs by supplying arbitrary `uuid` parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the 'content-get-list' endpoint and then submit crafted POST requests to the 'list-images' and 'delete-image' endpoints in 'bl-kernel/ajax/' to access and destroy media files outside their own pages, bypassing the IMAGE RESTRICT isolation control. **Recommendations** Update Bludit CMS to version 3.22.1 or later. Restrict access to the 'bl-kernel/ajax/' endpoints to minimize the risk of exploitation.