Bytejmp

**Name of the Vulnerable Software and Affected Versions** liketrek TREK versions prior to 3.1.0 **Description** Remote manipulation of the `loginUser()` function within the `server/src/services/authService.ts` file of the Pre-2FA mfa token Handler component leads to improper authentication. **Recommendations** Update to version 3.1.0.

**Name of the Vulnerable Software and Affected Versions** liketrek TREK versions prior to 3.1.0 **Description** An issue in the Journey Entry Update component allows for remote SQL injection. This occurs within the `journeyService.updateEntry()` function located in the server/src/nest/journey/journey.controller.t file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Upgrade to version 3.1.0.

**Name of the Vulnerable Software and Affected Versions** liketrek TREK versions prior to 3.1.0 **Description** An issue in the OIDC Service component within the `findOrCreateUser()` function of the `server/src/services/oidcService.ts` file allows for improper authentication. This flaw can be exploited remotely, although the attack requires a high level of complexity and is considered difficult to execute. **Recommendations** Update to version 3.1.0.

**Name of the Vulnerable Software and Affected Versions** liketrek TREK versions prior to 3.1.0 **Description** A path traversal flaw exists in the Public Journey Photo Proxy component within the file `server/src/nest/journey/journey-public.controller.ts`. This issue allows a remote attacker to perform a manipulation that results in unauthorized access to files and directories. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** Update to version 3.1.0.

**Name of the Vulnerable Software and Affected Versions** liketrek TREK versions prior to 3.1.0 **Description** An issue exists in the Journey Photo Proxy component where the `validateShareTokenForAsset()` function can be manipulated. This flaw allows a remote attacker to achieve incorrect authorization, although the attack is characterized by high complexity and is difficult to exploit. **Recommendations** Upgrade to version 3.1.0.