Izumi-Hyun

**Name of the Vulnerable Software and Affected Versions** OpenEXR versions 3.1.0 through 3.2.10 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 **Description** An integer overflow occurs during an `int32 t` multiplication within the `unpack sample table()` function of OpenEXRCore when decoding a specially crafted deep tiled EXR file. This overflow happens in the standard decoding path `exr decoding run`, resulting in an invalid pointer that causes a read from an unmapped memory address and a subsequent application crash. **Recommendations** Update versions 3.1.0 through 3.2.10 to version 3.2.11. Update versions 3.3.0 through 3.3.12 to version 3.3.13. Update versions 3.4.0 through 3.4.13 to version 3.4.14.

**Name of the Vulnerable Software and Affected Versions** Grav API Plugin versions prior to 1.0.10 **Description** Authenticated users with `api.config.write` privilege can modify security-critical plugin configuration scopes. This allows attackers to disable site-wide rate limiting, facilitating credential brute-forcing attacks, and reconfigure Cross-Origin Resource Sharing (CORS) policies to include attacker-controlled origins with credentials enabled. **Recommendations** Update Grav API Plugin to version 1.0.10 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API Plugin versions prior to 1.0.10 **Description** An issue exists where the software fails to properly validate the `slug` field in the 'POST /pages/{route}/move' endpoint. The `PagesController::move()` function only strips leading periods, failing to neutralize '/' or '..' segments. This allows an authenticated API caller with the `api.pages.write` permission to use path traversal sequences to move an entire page directory, including content and media, to an arbitrary writable location outside the `user/pages/` directory, potentially extending beyond the Grav installation. **Recommendations** Update Grav API Plugin to version 1.0.10 or later. Avoid using the `slug` parameter in the 'POST /pages/{route}/move' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Grav API Plugin versions prior to 1.0.10 **Description** Insufficient validation of the `groups` field within the `InvitationsController::create()` function allows authenticated users with `api.users.write` permissions to assign invited accounts to groups that grant `api.super` permissions. This enables an attacker to create invitation records with elevated group membership, granting the new account full super-admin API access regardless of the inviter's own permission level. **Recommendations** Update Grav API Plugin to version 1.0.10 or later.