Avrlab233

**Name of the Vulnerable Software and Affected Versions** Handlebars.java versions prior to 4.5.5 **Description** An issue allows directory traversal when using a Spring MVC application with a `file:` template prefix and a request-derived view name. In certain versions, template locations are validated as raw percent-encoded strings, but the template file is opened via a URL handler that percent-decodes the path. This allows a percent-encoded traversal sequence, such as `%2e%2e/`, to bypass the view-resolver check and the loader-side containment, enabling the reading of files outside the configured template base directory. **Recommendations** Update Handlebars.java to version 4.5.5 or later.

**Name of the Vulnerable Software and Affected Versions** vulnerability-lookup (affected versions not specified) **Description** The account recovery functionality contains a time-of-check-to-time-of-use (TOCTOU) race condition—a scenario where a system checks a condition and then uses the result, but the condition changes between the check and the use—during the consumption of single-use recovery tokens. This occurs because the system verifies the token nonce and clears it in separate database operations. Consequently, two concurrent HTTP requests using the same valid token can both pass verification, allowing an attacker with a valid token to overwrite a legitimate user's password. Additionally, the `/user/confirm account/<token>` endpoint allows setting empty or trivially short passwords because the view handler performs a manual equality comparison between password fields without invoking the form's validation logic, bypassing complexity and length constraints. The issue resides in the `User` model (`website/models/user.py`) and the view layer (`website/web/views/user.py`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.