Andrew Lacambra

**Name of the Vulnerable Software and Affected Versions** Bogo plugin for WordPress versions prior to 3.9.2 **Description** An issue exists where authenticated attackers with subscriber-level access and above can extract the raw title, content, excerpt, and password of private, draft, or password-protected posts. This occurs by triggering a duplication of the post via the translation endpoint 'bogo rest create post translation' and reading the returned `title.raw`, `content.raw`, and `excerpt.raw` fields. The issue is exploitable against posts written in a non-default locale, as subscribers can request a translation into the site's default locale to bypass the locale-only permission gate. While subscribers can trigger the endpoint, the impact is primarily at the Contributor-level, as they possess the necessary permissions to read the duplicated content. **Recommendations** Update the plugin to version 3.9.2 or later. As a temporary workaround, restrict access to the 'bogo rest create post translation' endpoint for users with low-level privileges.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions prior to 2.4.67 **Description** A heap-based buffer overflow exists in the `mod proxy ajp` module. If `mod proxy ajp` connects to a malicious AJP server, that server can send a crafted AJP message causing the system to write four attacker-controlled bytes beyond the end of a heap-based buffer, leading to memory corruption. **Recommendations** Upgrade to version 2.4.67.