Kuniyoshi Noguchi

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.

Splunk MCP Server contains a Server-Side Request Forgery (SSRF) flaw where the platform authentication token of a user running a custom API tool may be sent to the URL configured for that tool. If an attacker controls the destination URL, they can capture the token to access data and perform actions on behalf of the affected user. Exploitation requires a user with the `mcp tool execute` capability to execute a custom API tool configured by another user.

A stored cross-site scripting issue exists involving custom content descriptions. This flaw allows an arbitrary script to be executed within the web browser of a user who views the affected content.

When converting baserCMS4-style addons to baserCMS5-style ones, the `BcAddonMigrator` function includes the "config.php" file from the addon, leading to the execution of the PHP code contained within that file. This allows an administrative user to read or delete arbitrary files on the system.

Users with the admin Splunk role can execute arbitrary commands on the underlying operating system. This occurs due to missing input validation within the credential management component, which performs deserialization—the process of converting stored data back into an object—without verifying if the content matches the expected type.

An unauthenticated remote client can cause the internal localized-text caches to grow without bound and exhaust the Java heap, leading to a denial of service. This occurs when no fixed locale is configured, as the framework takes the locale used for localized-text lookups directly from the incoming request.

A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users.

Missing authorization allows forceful browsing within the module that provides the entity type and runtime for agents to use tools. The issue occurs because the module does not sufficiently check required permissions when a tool loads content entities. Exploitation requires that an agent be configured to use the affected tool and that the attacker has access to that agent.

Insufficient sanitization of user-supplied URLs leads to a Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. Exploitation requires the attacker to have permissions to modify the host URL and the ability to generate AI-generated images.