Ambulong

**Name of the Vulnerable Software and Affected Versions** jqueryFileTree versions 2.1.5 and older **Description** The issue is related to Directory Traversal. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. Technical details about exploitation include sending a request to the `/js/jqueryfiletree-2.1.5/dist/connectors/jqueryFileTree.php` endpoint with a `dir` parameter set to `/`, allowing an attacker to traverse directories. **Recommendations** For jqueryFileTree versions 2.1.5 and older, as a temporary workaround, consider restricting access to the `jqueryFileTree.php` file until a patch is available. Avoid using the `dir` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DokuWiki versions 2016-06-26a and older **Description** The issue allows users to scan ports of internal networks via SSRF, affecting private networks such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16, when media file fetching is enabled. This is due to the `sendRequest` method in the `HTTPClient` Class in the file `/inc/HTTPClient.php` having no access restrictions. **Recommendations** For DokuWiki versions 2016-06-26a and older, consider disabling media file fetching to prevent SSRF attacks until a patch is available. Restrict access to the `sendRequest` method in the `HTTPClient` Class to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** DokuWiki versions 2016-06-26a and older **Description** The issue allows a remote unauthenticated attacker to change the hostname in the password-reset URL via the HTTP Host header, potentially leading to phishing attacks. This can be triggered if the Host header is not part of the web server routing process, such as when multiple domains are served by the same web server. **Recommendations** For DokuWiki versions 2016-06-26a and older, consider updating to a version that uses the baseurl setting instead of `$ SERVER['HTTP HOST']` for the password-reset URL. As a temporary workaround, ensure that the Host header is part of the web server routing process to prevent exploitation. Restrict access to the password-reset functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.