Kazuma Matsumoto

A use-after-free condition exists in the Windows exFAT File System. This issue allows an authorized attacker to elevate privileges locally on the system. Use-after-free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.

An Insecure Direct Object Reference exists due to the `b2s ship item` and `b2s ship item reload url` AJAX handlers lacking per-object authorization on the `postId` parameter. This allows authenticated attackers with Contributor-level access or higher to read the title and content of any post, including private and pending posts belonging to other users.

An issue exists where the `getCurrentTaskResults()` function in `modules/workspace/controller.php` is accessible without authentication or authorization. This occurs because the function is missing from the `getNoncedMethods()` array, the `getPermissions()` function returns an empty array, and AJAX actions are registered using `wp ajax nopriv ` hooks. Unauthenticated attackers can enumerate sequential task IDs to retrieve sensitive data from the JSON response, including plaintext OpenAI API keys, AI prompts, keywords, and full AI model configurations stored in the database.

Unauthorized data modification is possible due to a missing capability check and missing nonce verification in the `ajax import 410()` function. While other AJAX handlers in the same class implement proper authorization and nonce checks, this specific function allows authenticated attackers with Subscriber-level access and above to import arbitrary URLs into the 410 Gone database table via the `surfl import 410` AJAX action. This can lead to the site returning HTTP 410 Gone responses to visitors accessing those paths, potentially resulting in a denial of service for legitimate pages and SEO damage through search engine delisting.

The plugin contains a missing authorization flaw resulting from the absence of capability checks and nonce verification on AJAX actions registered under `wp ajax ` and `wp ajax nopriv ` hooks. This occurs because the base controller's `getPermissions()` function returns an empty array and the `removeGroup` and `clear` methods are not included in `getNoncedMethods()`, causing the authorization gate to unconditionally allow these actions. Consequently, unauthenticated attackers can delete specific records by ID or wipe all records from any module's database table.

Authenticated attackers with Contributor-level access and above can perform unauthorized modification of data. This is caused by a missing capability check in the `genolve setOpt()` function, allowing the update of arbitrary WordPress options. This can lead to privilege escalation by enabling user registration and setting the default role to administrator.

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can exploit this by providing arbitrary scenario IDs to publish draft WordPress posts, exposing unpublished content, or unpublish live content, which may lead to service disruption.

An uncontrolled search path element issue allows for DLL hijacking. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.

Incorrect default permissions allow an attacker to place a malicious executable within the installation folder. This can lead to arbitrary code execution with SYSTEM privilege, which is the highest level of administrative access on a Windows system.

An out-of-bounds read occurs in the `check server certificate()` function when processing a Certificate handshake message. Unauthenticated attackers can trigger reads beyond valid buffer boundaries by providing a specific `fragment length` value. This is possible due to missing buffer length validation before `uint24` reads, `memcmp`, and `memcpy` operations during DTLS epoch 0 on both client and server paths, which can lead to a denial of service on memory-constrained devices.

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts via authentication endpoints.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping involving the `X-Forwarded-For` header. Unauthenticated attackers can inject arbitrary web scripts into pages, which then execute when a user accesses the affected page. Practical exploitation is limited by a 20-character storage limit.

The FastBots plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping in admin settings. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled.

The Continually plugin for WordPress contains a Stored Cross-Site Scripting issue in the admin settings caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a flaw allowing unauthenticated attackers to append additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query within the `getListForTbl()` function. This can lead to the extraction of sensitive information from the database. SQL Injection is a technique where an attacker inserts malicious SQL code into a query to manipulate the database.

A denial-of-service issue exists in the ext4 directory parsing within `fs/ext4/ext4 common.c`. The `ext4fs iterate dir()` function does not validate that directory entry length values are non-zero. An attacker can provide a malicious ext4 filesystem image containing a crafted directory entry with a `direntlen` value of 0, triggering an infinite loop during path resolution or directory listing, which causes the boot process to hang indefinitely.

Multiple memory-safety issues exist in the EFI PE loader within the `efi/loader/pe.c` file. An integer overflow occurs during virtual image size computation when using 32-bit arithmetic on section `VirtualAddress` and size values, leading to undersized heap allocation. Additionally, the PE section loading logic does not validate if `PointerToRawData` plus the copied size stays within the PE file buffer. An attacker can provide a malicious EFI PE binary through TFTP, USB, SD card, or network boot to trigger a heap buffer overflow or an out-of-bounds read from heap memory, which could allow code execution in the bootloader context.

An out-of-bounds read exists in the ext4 extent parsing process due to missing validation of the `eh entries` field against buffer capacity within the `fs/ext4/ext4 common.c` file. An attacker can trigger heap out-of-bounds reads during boot-time filesystem parsing by providing a malicious ext4 filesystem image via USB, SD card, or network boot, which may allow redirecting reads to arbitrary disk offsets.