Imduong

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.14.0 through 4.14.6 **Description** An authenticated low-privilege user can read the cluster secret from the manager configuration. This occurs because the logic used to mask sensitive values is disabled whenever any update-config Role-Based Access Control (RBAC) rule exists, regardless of whether the rule is set to allow or deny. Specifically, the `mask sensitive config()` decorator only applies masking if the ` has update permissions()` function returns false. However, ` has update permissions()` considers a user to have update permissions if a `manager:update config` or `cluster:update config` rule is present, failing to verify the rule's actual effect. Consequently, an account explicitly denied configuration edits is incorrectly treated as having update permissions, disabling the masking. An authenticated GET request to the configuration endpoint using the `raw=true` parameter can then return the `ossec.conf` XML file containing the `cluster.key` in clear text. **Recommendations** Update to version 4.14.7.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.6 **Description** Authenticated attackers can delete arbitrary files due to insufficient sanitization of path traversal sequences in the `existing image` field during category updates. This issue occurs within the `Image::delete()` function. By deleting the `database.php` configuration file, an attacker can disable the installation gate and gain access to the public setup wizard to create new superadmin accounts. **Recommendations** Update to version 4.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.6 **Description** A remote code execution issue exists in the configuration API. Authenticated administrators possessing `CONFIGURATION EDIT` and `ATTACHMENT ADD` privileges can write arbitrary PHP files by manipulating the `upgrade.lastDownloadedPackage` setting. The process involves uploading a malicious ZIP file as an attachment, directing the updater configuration to the stored path of that file, and extracting it into the application root to execute code as the web server user. **Recommendations** Update phpMyFAQ to version 4.1.6 or later.