Imlonghao

Staff members assigned the Author role can delete posts and pages that they did not create.

Wavelog exposes the endpoints '/install/ajax.php' and '/install/includes/interface assets/triggers.php' after installation without requiring an installation lock or permission check. Unsanitized input reaches the functions `write config()` and `write configfile()` in install/includes/core/core class.php, enabling a remote unauthenticated attacker to read or write log files and insert controlled content into PHP configuration files, which can lead to remote code execution on the server.

authentik is an open-source identity provider. A malformed cookie could bypass authentication when using forward authentication with the authentik Proxy Provider in conjunction with Traefik or Caddy as a reverse proxy. The absence of authentik-specific X-Authentik-* headers with a malicious cookie could grant access to an attacker, depending on the application.

Name of the Vulnerable Software and Affected Versions: Komari versions prior to 1.0.4-fix1 Description: Komari is a server monitoring tool. A Cross-Site WebSocket Hijacking (CSWSH) issue exists in the WebSocket upgrader due to disabled origin checking, potentially allowing remote code execution against authenticated users. An attacker can send requests to the terminal websocket endpoint with the victim's browser cookies. Recommendations: Update to version 1.0.4-fix1 or later.

Discourse is an open source discussion platform. A malicious user can cause a regular expression denial of service using a carefully crafted git URL.

The issue affects the parsing of posts in Discourse, making it susceptible to regular expression denial of service (ReDoS) attacks. This allows for potential disruption of service. There are no known workarounds for this issue.