Akokonunes

The ActivityAMP AMP message renderer in `app/src/main/java/eu/faircode/email/ActivityAMP.java` enables JavaScript in its WebView but fails to completely sanitize untrusted message HTML. For hosts not on the allowlist, the process of removing the `src` attribute from script elements leaves inline scripts in the document and fails to reject event-handler attributes or `javascript:` URLs on other elements. This allows a crafted AMP email to execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The executed script can read the message DOM (Document Object Model), exfiltrate message data, and display phishing overlays within the message-body area.

Stored cross-site scripting occurs in asset serving because the extension blocklist is incomplete and fails to include script-capable file types. This allows attackers to upload files with extensions such as `.xht`, `.ehtml`, `.xsl`, `.xbl`, or `.rdf` that resolve to executable media types. Consequently, JavaScript can be executed to steal API tokens and compromise workspaces.

When configured with proxy authentication (`auth.method=proxy`), the software improperly trusts upstream identity headers without validating that requests originate from a trusted proxy. An unauthenticated attacker with direct access to the server can impersonate any user, including the administrator, by sending a forged HTTP header. Furthermore, providing a non-existent username in the header triggers the automatic creation of a new user account, allowing unauthorized account provisioning. This leads to full administrative account takeover and complete compromise of server-side file management.

The application registers a custom `org.traccar.client://config` deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or notification. An attacker can use a crafted link delivered via SMS, email, a webpage, or another app to hijack GPS tracking parameters, including the server URL, device ID, accuracy, distance, and interval. This enables the covert redirection of real-time GPS telemetry to an attacker-controlled server at maximum precision and frequency, with the changes persisting across device restarts.

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.1 Description Directus is susceptible to an open redirect issue through the `redirect` parameter on the `/admin/tfa-setup` page. An administrator who has not configured Two-Factor Authentication (2FA) may be redirected to an attacker-controlled URL after completing the 2FA setup process, as the application lacks validation of the redirect destination. This could be leveraged in phishing attacks targeting Directus administrators. Recommendations Update to version 11.16.1 or later.

Cloud CLI (also known as Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. The `/api/user/git-config` endpoint constructs shell commands using user-provided `gitName` and `gitEmail` values, passing them to `child process.exec()`. Input is placed within double quotes, but only double quotes are escaped, leaving backticks (`), `$()` command substitution, and `` sequences vulnerable to interpretation within bash. This allows authenticated attackers to execute arbitrary operating system commands through the git configuration endpoint. The vulnerable code resides in `server/routes/user.js` (lines 58-59). Exploitation involves injecting malicious commands via the `gitName` parameter using command substitution, potentially leading to Remote Code Execution (RCE) as the Node.js process user. The server-wide git configuration can be modified, impacting all git operations. When combined with a bypass for JWT authentication, this can result in unauthenticated RCE.

The `/objects/playlistsFromUser.json.php` endpoint does not require authentication or authorization, allowing an unauthenticated attacker to enumerate user IDs and retrieve playlist information, including playlist names, video IDs, and playlist status, for any user on the platform. The endpoint accepts a `users id` parameter and directly queries the database without any authentication or authorization checks. This can lead to privacy violations, user enumeration, information gathering, and potential targeted attacks. The vulnerable file is `objects/playlistsFromUser.json.php`. The `getAllFromUser()` function is used to retrieve playlist data without verifying user access.

The software contains a reflected cross-site scripting (XSS) issue in the `/rss/tag/` endpoint. The `tag uuid` path parameter is directly included in the HTTP response without proper HTML escaping. Because Flask defaults to `text/html` for string responses, injected JavaScript is executed by the browser. The issue was present in version 0.54.1, which addressed a similar XSS in `/rss/watch/` but did not resolve the problem in the tag RSS endpoint. The attack requires a valid RSS access token, which is publicly available on the homepage. Successful exploitation could lead to session cookie theft, account takeover, and phishing attacks. Approximately 500 publicly accessible deployments are estimated to be affected. The vulnerable code is located in `changedetectionio/blueprint/rss/tag.py` at line 36. The vulnerable parameter is `tag uuid`.

NocoDB is software for building databases as spreadsheets. An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells. This is achieved by bypassing the TipTap editor and sending raw HTML via the API. The vulnerable API allows for the injection of malicious code through Rich Text cells.

A stored cross-site scripting (XSS) issue exists in the Formula virtual cell of NocoDB, a software used for building databases as spreadsheets. Formula results containing URI::() patterns are rendered using v-html without proper sanitization, which allows for the execution of injected HTML.

The application reflects the `UUID` path parameter directly in the HTTP response body without HTML escaping in the RSS single-watch endpoint. Because Flask defaults to returning text/html for plain string responses, the browser parses and executes injected JavaScript. This could allow for potential cross-site scripting (XSS) attacks.