Geochen

A security flaw exists in the SMB Service component within the `etc/init.d/service smbd.sh` file. Improper initialization occurs when the `ANON ACCESS` argument is manipulated, allowing a remote attacker to initiate an attack without authentication.

A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

An authentication bypass exists in the JNAP API component within the `ui server.lua` file. A remote attacker can manipulate the `isEnabled`/`enabled` argument in the `SetRemoteSetting/SetUnsecuredWiFiWarning()` function to change the Wi-Fi unsecured warning settings or enable remote access to the router without providing credentials.

A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component.

An issue in the Catalog API component allows for improper authentication. This can be triggered remotely through the `AddApplicationServices()` function located in the src/Catalog.API/Extensions/Extensions.cs file.

Improper authorization occurs in the History Deletion Handler component within the `CanDeleteHistory()` function located in the internal/chore/model/model.go file. A remote attacker can manipulate the `AssignedTo` argument to bypass authorization checks. This issue is related to Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input.

An authorization bypass exists in the Webhook Handler component. A remote attacker can manipulate the `ID` argument within the `createWebhookProcedure()` function located in the packages/trpc/server/routers/viewer/webhook/util.ts file to bypass security checks.

An issue exists in the System API component within the `systemAPI.Run()` function of the `internal/proxy/api.go` file. A remote attacker can perform a manipulation that results in missing authentication, allowing unauthorized access to the system.

A flaw in the SVG Handler component, specifically within the `sanitizeElement()` function of the `processing/svg/svg.go` file, allows for remote cross-site scripting. Cross-site scripting is a technique where malicious scripts are injected into trusted websites.

A remote information exposure issue exists due to verbose error handling in the `Login()` function within the `pkg/org/user handler.go` file. This flaw allows a remote attacker to use the login handler as a tool for username lookup by analyzing the error messages returned by the system.

A flaw in the Proxy Fallback Handler component allows for server-side request forgery, which occurs when an attacker can induce the server to make requests to an unintended location. This issue is located in the `proxyHandler()` function within the `app/api/proxy.ts` file and is triggered by manipulating the `x-base-url` argument. The attack can be initiated remotely.

An issue exists in the Ordering API component within the `GetOrderAsync()` function located in the `src/Ordering.API/Apis/OrdersApi.cs` file. A remote attacker can manipulate the `OrderNumber` argument to cause improper control of resource identifiers, which occurs when a system fails to properly validate that a user is authorized to access a specific resource identifier.

A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the `api key` argument within the `server info()` function located in the python/sglang/srt/entrypoints/http server.py file.

A server-side request forgery (SSRF) issue exists in the Fetch Tool component. The vulnerability occurs within the `fetch url()` function located in the `mcp server fetch/server.py` file. A remote attacker can trigger this by manipulating the `url` or `path` arguments, allowing the server to make unauthorized requests to private IP addresses, loopback interfaces, or metadata services.

A security flaw in the PBAC Permission Engine component allows for missing authorization. The issue resides in the `doesUserIdHaveAccessToBooking()` function within the `BookingAccessService.ts` file. This flaw can be exploited remotely through manipulation to bypass authorization checks.

Improper authorization occurs in the Shared Link Preview Handler component within the `checkSharedLinkAccess()` function located in server/src/utils/access.ts. A remote attacker can exploit this by manipulating the `Password` argument to bypass authorization controls.

An issue exists in the OAuth Scope Handler component within the `instancePeers()` function of the `app/Http/Controllers/Api/ApiV1Controller.php` file. Remote manipulation of the `ID` argument can lead to missing authentication.

Missing authentication in the Validate Route component allows remote attackers to manipulate the `internalCertificate.validate()` function within the `backend/internal/certificate.js` file. The endpoint processes and echoes back the submitted certificate, leading to unauthenticated OpenSSL processing of attacker-controlled input.