Andrew Lacambra

An issue exists where authenticated attackers with subscriber-level access and above can extract the raw title, content, excerpt, and password of private, draft, or password-protected posts. This occurs by triggering a duplication of the post via the translation endpoint 'bogo rest create post translation' and reading the returned `title.raw`, `content.raw`, and `excerpt.raw` fields. The issue is exploitable against posts written in a non-default locale, as subscribers can request a translation into the site's default locale to bypass the locale-only permission gate. While subscribers can trigger the endpoint, the impact is primarily at the Contributor-level, as they possess the necessary permissions to read the duplicated content.

A heap-based buffer overflow exists in the `mod proxy ajp` module. If `mod proxy ajp` connects to a malicious AJP server, that server can send a crafted AJP message causing the system to write four attacker-controlled bytes beyond the end of a heap-based buffer, leading to memory corruption.