Dahmani Toumi

An authorization flaw exists in the `get open activities()` function within `erpnext.crm.utils`. This issue allows any authenticated user, including those with portal access or no assigned roles, to access ToDo and Event records. By providing arbitrary values to the `ref doctype` and `ref docname` variables, an attacker can enumerate activities and retrieve private calendar event details.

An authentication bypass exists in `X509Authenticator` and `X509AuthenticationListener` where an attacker possessing a certificate from a trusted CA can authenticate as an arbitrary user, including privileged accounts, by influencing the Common Name (CN). The issue stems from an incomplete fix where the regular expression used to extract user identifiers from the Subject DN (Distinguished Name) passed in `$ SERVER['SSL CLIENT S DN']` was not escape-aware. Consequently, the system fails to distinguish between actual RDN (Relative Distinguished Name) separators and separator characters contained within a value. Under RFC 2253, escaped commas are incorrectly read as separators, and bare slashes are treated as separators. In the legacy `X509 NAME oneline()` format, bare commas are treated as separators. This allows a poisoned CN to smuggle a different user address for authentication.

WebinarIgnition contains an issue where improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questions and determines the answer based on the application's response.

A vulnerability exists in the NuPoint Unified Messaging (NPM) component that could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.