Djnn

**Name of the Vulnerable Software and Affected Versions** ProFTPD versions 1.3.9b through 1.3.10rc2 **Description** An access control bypass allows authenticated FTP users to circumvent Directory ACL restrictions. By prefixing paths with `/proc/self/root` in the `RNFR` command handler, attackers can exploit unresolved symlink components in the `dir canonical path()` function. This causes the `dir check()` function to perform lexical path comparisons that do not match any configured Directory block, enabling rename operations on files in DenyAll-protected directories and the subsequent retrieval of those files. Approximately 3.8 million instances are identified globally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Configure sessions with DefaultRoot (chroot) to prevent the bypass, as this changes the directory to which `/proc/self/root` resolves.

**Name of the Vulnerable Software and Affected Versions** Bootimus versions 0.1.0 through 0.1.70 dhcpcd versions 1.0 through 10.3.2 **Description** Bootimus contains a broken access control issue where the `JWTMiddleware()` function in internal/auth/auth.go fails to inspect the `is admin` flag. This allows authenticated low-privileged users to perform administrative actions via any endpoint under the `/api/users` path, such as creating new administrator accounts or resetting administrator passwords, leading to full server control and the ability to modify boot menus and installation scripts for PXE clients. dhcpcd contains a one-byte stack out-of-bounds write in the `dhcp6 makemessage()` function in src/dhcp6.c. An unauthenticated attacker on the same link can trigger this by sending a crafted DHCPv6 ADVERTISE message with an IA PD IAPREFIX /0 and an oversized RFC6603 OPTION PD EXCLUDE option body using an exclude prefix length between /121 and /128, potentially corrupting adjacent stack memory. **Recommendations** For Bootimus versions 0.1.0 through 0.1.70, restrict access to the `/api/users` endpoint to prevent unauthorized administrative actions. For dhcpcd versions 1.0 through 10.3.2, apply the fix provided in commit 2f00c7b.

**Name of the Vulnerable Software and Affected Versions** AdGuard Home versions prior to 0.107.77 **Description** When started with the `--glinet` flag, the software contains an authentication bypass that allows unauthenticated attackers to gain full administrative access. This occurs due to unsanitized string concatenation in the token file path construction within the `authglinet` middleware. Attackers can use a path traversal sequence in the `Admin-Token` cookie to redirect file reads to arbitrary paths. Over 122,000 potentially affected devices have been identified worldwide. **Recommendations** Update to version 0.107.77 or later.

**Name of the Vulnerable Software and Affected Versions** libusb versions prior to 1.0.30 **Description** A NULL pointer dereference occurs when a malformed USB configuration descriptor is supplied. Specifically, if an interface claims `bNumEndpoints` greater than zero but is followed by a class-specific descriptor with a `bLength` exceeding the remaining buffer size, the `parse interface()` function returns early without allocating the endpoint array. This can be exploited via the functions `libusb get active config descriptor` or `libusb get config descriptor` by providing crafted descriptors through network sources, file-based descriptor parsing, or virtualized USB passthrough, leading to an application crash when iterating over endpoints. **Recommendations** Update to version 1.0.30 or later.

**Name of the Vulnerable Software and Affected Versions** SuiteNumerique Messages versions 0.2.0 **Description** A security flaw exists in the ThreadAccessSerializer function within the src/backend/core/api/serializers.py file of the ThreadAccess component. This flaw leads to improper authentication and can be exploited remotely. The exploit for this issue has been publicly released. The vulnerable component should be upgraded. **Recommendations** Upgrade to version 0.3.0.