Julien Ahrens

A heap-based buffer overflow occurs in the `find free number()` function during the generation of numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, a specially crafted Transport Neutral Encapsulation Format (TNEF) file containing an excessive number of colliding attachment filenames can cause the numeric counter to write beyond the allocated memory buffer. This may lead to an application crash, resulting in a Denial of Service (DoS), or potentially allow arbitrary code execution.

A flaw exists where a remote attacker can cause a Denial of Service (DoS) by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file containing multiple message bodies. During the extraction process, improper memory management leads to a use-after-free (where the program continues to use a pointer after it has been freed) and a double-free (where the program attempts to free the same memory location twice) condition, resulting in an application crash.

A flaw exists where the application fails to properly validate input buffer boundaries before copying data in the `get rtf data from buf()` function. An attacker can exploit this by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data, causing the application to read beyond the allocated memory. This can result in a Denial of Service (DoS) due to application crashes or the leakage of sensitive memory contents into extracted output files.

A path traversal issue exists in the decryption functionality when processing the `filePath` property. This allows a malicious export to write arbitrary content to any path on the victim's filesystem, which can lead to remote code execution (RCE), a state where an attacker can execute arbitrary commands on the target machine.

The key/value endpoint in Consul and Consul Enterprise is susceptible to a denial of service (DoS) condition. This is caused by improper validation of the Content Length header.

The event endpoint in Consul and Consul Enterprise is susceptible to a denial of service (DoS) condition. This is caused by the absence of a maximum value restriction on the Content Length header. A malicious actor could potentially exploit this to disrupt service availability.

Wing FTP Server is affected by a critical remote code execution (RCE) vulnerability (CVE-2025-47812) stemming from improper handling of null bytes ('0') in the web interfaces. This allows attackers to inject arbitrary Lua code into user session files, potentially executing arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). The vulnerability is exploitable even with anonymous FTP accounts. Active exploitation of this flaw has been observed, with attackers attempting to gain root/SYSTEM access, scan systems, and install malware. Over 8,100 systems are estimated to be exposed, including those belonging to the U.S. Air Force and Airbus. The vulnerability allows for unauthenticated remote code execution. The `loginok.html` endpoint is a target for exploitation.

Name of the Vulnerable Software and Affected Versions: Wing FTP Server versions through 7.4.4 Description: The administrative web interface (listening by default on port 5466) runs with elevated privileges (root or SYSTEM) by default. The web application provides methods to execute arbitrary system commands, which are automatically executed with these high privileges. This situation may lead to privilege escalation, as administrative users of the web interface are not necessarily system administrators. Recommendations: Versions prior to 7.4.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Wing FTP Server contains an information disclosure issue in the `loginok.html` file. The vulnerability occurs when a long value is provided in the `UID` cookie. This allows a remote attacker to disclose the full local installation path of the application. This vulnerability is actively exploited in the wild and has been observed being chained with remote code execution exploits. Attackers have leveraged this vulnerability to download malicious Lua files and install Remote Monitoring and Management (RMM) tools. CISA has added this vulnerability, identified as CVE-2025-47813, to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within a specified timeframe. The vulnerability is triggered by improper validation of the `UID` cookie value.

The issue is related to a protection mechanism failure in Intel Data Center Manager software, which may allow an unauthenticated user to potentially enable escalation of privilege via network access. This could permit a remote attacker to elevate their privileges. The problem is described as an incorrect use of protection mechanisms.

The issue is related to Cross-Site Request Forgery due to missing nonce validation on the function associated with the `qsm remove file fd question` AJAX action. This allows unauthenticated attackers to delete arbitrary media files via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue concerns insufficiently protected credentials in the Intel(R) DCM software, which may allow an authenticated user to potentially enable information disclosure via network access.

An issue was discovered in the firewall's endpoint at "/spcgi.cgi" that allows sessionid information disclosure via an invalid authentication attempt. This can be used to bypass the device's authentication and gain access to the administrative interface.

An issue in the firewall's endpoint at "/spcgi.cgi" allows information disclosure of memory contents to be achieved by an authenticated user. Uninitialized data can be retrieved via an approach in which a `sessionid` is obtained but not used.

The issue is related to insufficient control flow management, which may allow an authenticated user to potentially enable escalation of privilege via local access.

The issue is related to path traversal in the software, which may allow an authenticated user to potentially enable escalation of privilege via local access.

The issue is related to improper neutralization in the software, which may allow an authenticated user to potentially enable escalation of privilege via local access.

The issue is related to a missing capability check on the function associated with the `qsm remove file fd question` AJAX action. This allows unauthenticated attackers to delete arbitrary media files. The vulnerability can be exploited by a remote attacker to remove files.

The issue concerns PHP Object Injection via deserialization of untrusted input. This is made possible through the `import`, `mfn-items-import-page`, and `mfn-items-import` parameters passed through the `mfn builder import`, `mfn builder import page`, `importdata`, `importsinglepage`, and `importfromclipboard` functions. Authenticated attackers with contributor level permissions and above can inject a PHP Object, potentially allowing them to execute code, retrieve sensitive data, or delete files if a POP chain is present.

The issue is due to missing nonce validation when saving the plugin's settings, making it possible for unauthenticated attackers to update the plugin's settings, such as `betheme url slug`, `replaced theme author`, and `betheme label`, via a forged request. This can be achieved if attackers can trick a site administrator into performing an action, like clicking on a link.