David Carliez

A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log directory.  This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).

A local privilege escalation vulnerability in Thales SafeNet Authentication Client (SAC) SACSrv can allow an authenticated, non-administrator local user to trigger a heap-based buffer overflow through the service interface. Successful exploitation may allow arbitrary code execution with Local System privileges.This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).

An unrestricted file upload issue exists in the campaign import feature. When processing a campaign archive, the application copies bundled asset files into a publicly accessible media directory without restricting file names or types. An authenticated user with permissions to create campaign imports can exploit this via the user interface or the '/api/campaigns/import' endpoint to place arbitrary files, such as server-side scripts, in the web root. This does not require administrator privileges. On web servers that honor per-directory configuration, such as the default Apache setup in the official Mautic Docker image, this can lead to remote code execution with the privileges of the web server user, granting access to application secrets, configuration, and contact data.

A use-after-free condition in Windows NTFS enables an authorized attacker to elevate privileges locally. A use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed.

Weak authentication in the Windows iSCSI Target service allows an unauthorized remote attacker to bypass security restrictions over a network.

Incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature. This occurs when tool invocation requests are sent through legacy HTTP endpoints while the `--enable-api` flag is active.

fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. While the verifier rejects the exact reserved token `telegram`, it fails to reject path separators or normalize the path before checking for the session file's existence. A remote HTTP client can bypass reserved session name controls by using a traversal token such as `../fast-mcp-telegram/telegram` to authenticate as the default legacy session, provided the default session file `~/.config/fast-mcp-telegram/telegram.session` exists. This allows an unauthenticated network client to access the Telegram account associated with the default session file, enabling them to read and send messages, make MTProto API calls, and use other available tool surfaces. The issue exists within the `SessionFileTokenVerifier.verify token()` function.