Angelej

**Name of the Vulnerable Software and Affected Versions** Volt versions prior to 1.7.0 **Description** The issue concerns a remote code execution vulnerability within Volt components. Malicious, user-crafted request payloads could potentially lead to remote code execution. Approximately 1.08 million downloads are at risk. **Recommendations** To resolve the issue, upgrade to version 1.7.0 or later. As a temporary workaround, consider restricting access to vulnerable components until a patch is applied. Avoid using malicious or user-crafted request payloads in the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.361 **Description** The issue allows any authenticated user to attach any existing private key on a Coolify instance to their own server. If the server configuration of IP/domain, port, and user matches with the victim's server configuration, then the attacker can use the "Terminal" feature and execute arbitrary commands on the victim's server. This potentially grants root access to other servers. **Recommendations** Coolify versions prior to 4.0.0-beta.361: Update to version 4.0.0-beta.361 or later to fix the issue. As a temporary workaround, consider restricting access to the `Terminal` feature until a patch is available. Additionally, review server configurations to ensure that IP/domain, port, and user settings do not match with other servers, minimizing the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.361 **Description** The issue allows any authenticated user to escalate their or other team members' privileges to any role, including the owner role. This also enables the attacker to kick every other member out of the team, including admins and owners, and access the `Terminal` feature to execute remote commands. **Recommendations** Coolify versions prior to 4.0.0-beta.361 should be updated to version 4.0.0-beta.361 to fix the issue.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.374 **Description** The issue allows an authenticated user to retrieve any existing private keys on a Coolify instance in plain text due to missing authorization. If the server configuration of IP/domain, port, and user matches with the victim's server configuration, the attacker can execute arbitrary commands on the remote server. **Recommendations** Coolify versions prior to 4.0.0-beta.374 should be updated to version 4.0.0-beta.374 to fix the issue.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.380 **Description** Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. The issue arises when the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, leading to cross-site scripting. **Recommendations** For versions prior to 4.0.0-beta.380, update to version 4.0.0-beta.380 to resolve the issue. As a temporary workaround, consider restricting access to the tags page or disabling the search functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.361 **Description** The issue is related to missing authorization in Coolify, allowing any authenticated user to access sensitive information, including `client id`, `client secret`, and `webhook secret`, for any GitHub or GitLab configuration by knowing the UUID of the model. **Recommendations** For versions prior to 4.0.0-beta.361, update to version 4.0.0-beta.361 or later to resolve the issue. As a temporary workaround, consider restricting access to the GitHub and GitLab configuration details page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.361 **Description** The issue is related to missing authorization in Coolify, allowing any authenticated user to revoke team invitations by providing a predictable and incrementing ID. This can result in a Denial-of-Service attack. **Recommendations** For versions prior to 4.0.0-beta.361, update to version 4.0.0-beta.361 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.361 **Description** The issue is related to missing authorization, allowing any authenticated user to access and modify the global Coolify instance OAuth configuration. This exposes sensitive information, including the `client id` and `client secret` for every custom OAuth provider. **Recommendations** For versions prior to 4.0.0-beta.361, update to version 4.0.0-beta.361 or later to resolve the issue. As a temporary workaround, consider restricting access to the global OAuth configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Laravel Pulse versions prior to 1.3.1 **Description** A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public `remember()` method in the `LaravelPulseLivewireConcernsRemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria: the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable component is the `remember(callable $query, string $key = '')` method in `LaravelPulseLivewireConcernsRemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. **Recommendations** For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider disabling the `remember()` function in the `LaravelPulseLivewireConcernsRemembersQueries` trait until a patch is available. Restrict access to the vulnerable `LaravelPulseLivewireConcernsRemembersQueries` trait to minimize the risk of exploitation. Avoid using the `remember()` method in Livewire components until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** livewire/livewire versions prior to 2.12.7 and v3.5.2 **Description** The issue is related to insufficient validation of uploaded file extensions in the Livewire framework for Laravel. An attacker can bypass validation by uploading a file with a valid MIME type and a malicious file extension, such as ".php". If certain criteria are met, including the use of the original file name, storage on a public disk, and a web server configured to execute ".php" files, the attacker can carry out a remote code execution (RCE) attack. **Recommendations** To resolve the issue, upgrade to release versions 2.12.7 or 3.5.2. As a temporary workaround, consider disabling the use of `$file->getClientOriginalName()` for filename composition, and restrict file storage to non-public disks. Additionally, ensure that the web server is not configured to execute ".php" files in the storage directory. There are no known workarounds for this vulnerability, and all users are advised to upgrade to a patched version.

**Name of the Vulnerable Software and Affected Versions** PHP-IMAP versions prior to 5.3.0 **Description** An unsanitized attachment filename allows any unauthenticated user to leverage a directory traversal vulnerability, which results in a remote code execution vulnerability. Every application that stores attachments with `Attachment::save()` without providing a `$filename` or passing unsanitized user input is affected by this attack. An attacker can send an email with a malicious attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`. The attacker can upload malicious code of any type and content at any location where the underlying user has write permissions. The attacker can also overwrite existing files and inject malicious code into files that, e.g., get executed by the system via cron or requests. **Recommendations** For versions prior to 5.3.0, update to version 5.3.0 or later to resolve the issue. As a temporary workaround, consider sanitizing the `$filename` parameter in the `Attachment::save()` method to prevent directory traversal attacks. Restrict access to the `Attachment::save()` method to minimize the risk of exploitation. Avoid using the `Attachment::save()` method without providing a sanitized `$filename` value until the issue is resolved.