Andrejtomci

An insecure direct object reference exists in the 'portal/lib/persist.php' endpoint. Authenticated portal patients can modify the settings of other patients by providing an arbitrary `setting patient` value. This allows attackers to insert or overwrite rows in the patient settings table to suppress notifications, tamper with consent flags, or alter portal preferences.

An insecure direct object reference exists in the `portal/lib/paylib.php` file. The system writes the request-supplied `form pid` or `patient id cc` (used in Sphere data) to the `onsite portal activity` table without verifying it against the current session patient. This allows authenticated portal patients to submit requests via `portal-save`, `review-save`, `AuthorizeNet`, `Stripe`, or `Sphere` to insert or modify forged payment-audit records within the billing records of other patients.

An authorization inconsistency exists between the web UI and the API regarding repository forking. The API endpoint `POST /api/v1/repos/{owner}/{repo}/forks` fails to verify the `CanCreateOrgRepo()` permission, checking only `IsOrgMember()`. This allows a read-only organization member, specifically those in teams where `can create org repo` is set to `false`, to create repositories within the organization namespace via the API. An attacker can exploit this by forking an existing repository back into the organization. Since the creator of the fork is granted full admin permissions, they can enable Actions and push malicious workflow files. Because the runner infrastructure and secret injection mechanisms rely on the organization's owner ID, the attacker can execute workflows that exfiltrate all organization-level CI/CD secrets, such as deploy keys, cloud credentials, and API tokens.

The `update snapshot()` function in src/terminal.c copies the visible terminal screen into the scrollback buffer during a snapshot. The process involves iterating through the `chars[]` array of each screen cell without an upper bound, relying solely on a NUL terminator to stop. When a cell fills all `VTERM MAX CHARS PER CELL` (6) slots—consisting of a base character and five combining marks—the bundled libvterm returns the array without a terminating NUL. This causes the loop to read past the fixed six-element array and append out-of-bounds values to a buffer reserved for only six characters. A program rendering output inside a :terminal window can trigger this behavior using a short byte sequence, resulting in a crash.

A reflected DOM-based XSS (Cross-Site Scripting) issue exists in `taillog.js`. An unauthenticated attacker can inject arbitrary HTML into the admin interface by crafting a malicious URL. This occurs because the `file` query parameter is interpolated into an `innerHTML` assignment without proper escaping. Additionally, the Content-Security-Policy lacks a `form-action` directive, which allows injected `<form>` elements to exfiltrate credentials to an external origin.

Client hostnames and IP addresses from the FTL database are rendered into the Document Object Model (DOM) without proper escaping in the Network page (network.js) and Dashboard chart tooltips (charts.js/index.js). Although upstream validation in dnsmasq and FTL blocks HTML characters through standard DHCP and DNS paths, the web interface fails to perform output escaping, creating an inconsistency with other properly escaped fields in the same files.

Configuration values from the '/api/config' endpoint are inserted into HTML value attributes without proper escaping in settings-advanced.js, allowing HTML attribute injection. A double quote in a configuration value allows an attacker to break out of the attribute context. While the server's Content Security Policy (CSP)—a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS)—prevents JavaScript execution, injected attributes can be used for UI redressing by altering element styling. The main attack vector involves importing a malicious teleporter backup, which bypasses server-side validation for individual fields.

The `formatInfo()` function in `queries.js` renders `data.upstream`, `data.client.ip`, and `data.ede.text` into HTML without proper escaping when a user expands a query row in the Query Log. This allows for stored HTML injection, although JavaScript execution is prevented by the server's Content Security Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including cross-site scripting and data injection.

calibre is an e-book manager used for viewing, converting, editing, and cataloging e-books. A path traversal flaw exists in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py). This allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a specially crafted .rb file. The issue stems from a failure to apply a previous fix for a similar flaw found in the PDB readers.