Dilipkumar Choudhary

**Name of the Vulnerable Software and Affected Versions** ION-DTN versions prior to 4.2.0 **Description** An out-of-bounds read exists in the `decodeSdnv()` function. Unauthenticated remote attackers can read memory by sending truncated SDNV (Self-Delimiting Numeric Value) values via a UDP datagram to the LTP link service input port. This action can trigger reads up to nine bytes beyond buffer boundaries and cause byte counters to underflow. **Recommendations** Update to version 4.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** GROWI versions prior to 8.0.2 **Description** An access control issue exists where the system fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they are not authorized to view by providing known attachment identifiers to the 'GET / api/v3/attachment/:id' endpoint. **Recommendations** Update GROWI to version 8.0.2 or later. Restrict access to the 'GET / api/v3/attachment/:id' endpoint to minimize the risk of unauthorized metadata retrieval.

**Name of the Vulnerable Software and Affected Versions** GROWI versions prior to 8.0.2 **Description** An access control issue exists in the GET '/ api/v3/revisions/:id' endpoint. The system validates access based on a query parameter but returns the revision specified by the path parameter `:id` without verifying that both refer to the same page. This allows authenticated attackers to use a page identifier they are authorized to access alongside an arbitrary revision identifier to read content from pages for which they lack permission. **Recommendations** Update GROWI to version 8.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Cloud Commander versions prior to 19.20.2 **Description** An issue exists in the REST file-operation and markdown endpoints due to improper validation of path normalization. This allows attackers to use path traversal sequences—a technique used to access files and directories that are stored outside the web root folder—to read, write, move, or copy files outside the configured root directory. **Recommendations** Update to version 19.20.2 or later.

**Name of the Vulnerable Software and Affected Versions** GROWI versions prior to 8.0.2 **Description** An authorization bypass exists when retrieving attachments. The system only applies page-viewer permission checks to attachment requests if the request is from an authenticated user. In the `retrieveAttachmentFromIdParam()` function located in `apps/app/src/server/routes/attachment/get.ts`, the permission check is guarded by a condition that requires the user to be non-null. Consequently, requests without a session skip this check entirely, allowing unauthenticated callers with a valid attachment identifier to access files via the '/attachment/:id' and '/download/:id' endpoints. This occurs regardless of whether the page owning the attachment is private or if the caller has the necessary permissions. Access is possible if identifiers were previously exposed or retained by users whose access was subsequently revoked. **Recommendations** Update GROWI to version 8.0.2.

**Name of the Vulnerable Software and Affected Versions** LeafWiki (affected versions not specified) **Description** An issue exists where the software extracts uploaded ZIP archives without limiting the amount of data written to the disk. The `ZipExtractor.ExtractToDir` function in `internal/importer/zip extractor.go` uses `io.Copy` to process entries, which continues until the decompressed stream ends. While the compressed upload is capped at 500 MiB, high compression ratios allow an archive to expand to hundreds of gigabytes. Since the extraction occurs in the operating system temporary directory, this can exhaust disk space or memory (if using a tmpfs-backed directory), allowing a user with the Editor or Admin role to cause a denial of service by consuming critical system resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** django-helpdesk versions prior to 2.3.3 **Description** A stored cross-site scripting issue allows unauthenticated attackers to inject arbitrary JavaScript. This is achieved by submitting HTML-formatted email messages or uploading `.html` or `.htm` file attachments via public ticket submission channels. The flaw stems from a lack of sanitization and missing Content-Disposition headers at the attachment-serving layer, enabling malicious scripts to execute in the browser session of authenticated staff members when they open the attachment during ticket triage. **Recommendations** Update django-helpdesk to version 2.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** FlatPress versions prior to commit 10be83c **Description** A stored cross-site scripting issue exists in comment and contact forms. The `name`, `URL`, and `email` fields are rendered without proper output encoding in Smarty templates. This allows attackers to inject arbitrary HTML and JavaScript to execute malicious scripts in the browsers of viewers, including administrators, or bypass URL scheme validation to inject `javascript:` or `data:` URIs. **Recommendations** Update to commit 10be83c or a later version.