Evilgensec

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.14.0 through 4.14.6 **Description** A low-privilege API user can access the cleartext cluster key through a configuration endpoint that fails to redact sensitive information. While the REST API typically uses a masking control called `mask sensitive config` to hide fields like `authd.pass` and `cluster.key` from users without `update-config` permissions, the 'GET /cluster/local/config' endpoint does not implement this control. This endpoint, which uses the `read config wrapper` function, only requires `cluster:read` permissions. Consequently, accounts with `readonly` or `cluster readonly` roles can retrieve the actual cluster key. Since this key is used to authenticate and encrypt traffic between cluster nodes, its disclosure can facilitate remote code execution chains between cluster peers. **Recommendations** Update to version 4.14. Restrict access to the 'GET /cluster/local/config' endpoint for users with `readonly` or `cluster readonly` roles until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.4.0 through 4.14.6 **Description** A flaw in the cluster file synchronization process allows an entity possessing the cluster key to write, overwrite, or delete arbitrary files within the `/var/ossec` directory on worker nodes, potentially resulting in remote code execution with root privileges. The issue occurs in the non-merged branch of the `update master files in worker()` function, where files are moved to a destination using `safe join()`. While this confines the path to `/var/ossec`, the system fails to verify if the file is placed in the directory specified by its `cluster item key`. This lack of destination verification, which is present on the primary node and the worker's merged branch, allows a peer to place files in attacker-controlled locations within `/var/ossec` that are executed as root. The delete branch contains the same deficiency. **Recommendations** Update to version 4.14.7.

Name of the Vulnerable Software and Affected Versions: Zitadel versions prior to 2.64.0 Zitadel versions prior to 2.63.5 Zitadel versions prior to 2.62.7 Zitadel versions prior to 2.61.4 Zitadel versions prior to 2.60.4 Zitadel versions prior to 2.59.5 Zitadel versions prior to 2.58.7 Description: The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check, disabling the "User Registration allowed" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Recommendations: Update to version 2.64.0 or later for the 2.x branch. Update to version 2.63.5 or later for the 2.63.x branch. Update to version 2.62.7 or later for the 2.62.x branch. Update to version 2.61.4 or later for the 2.61.x branch. Update to version 2.60.4 or later for the 2.60.x branch. Update to version 2.59.5 or later for the 2.59.x branch. Update to version 2.58.7 or later for the 2.58.x branch.