Leediay153

A stored cross-site scripting issue exists in the email viewer caused by a flawed regular expression in the `filterXSS()` function within `StringHelper`. Remote attackers can send emails containing malicious tags, such as `svg/onload`, which are rendered raw by `MessagePanel.js`. This allows the execution of arbitrary scripts within the session of the recipient when the email is opened.

Authenticated users can download form reports without proper permission checks. By requesting the `business/forms/report` blob using a specific form ID via the 'api/download.php' endpoint, an attacker can export all submissions as an XLSX file, leading to the disclosure of unauthorized data.

An arbitrary local file read issue exists in the `actionProcessUploadQueue()` function of the `FolderController`. Authenticated users can read server files by providing absolute paths within the `blobs` parameter. This allows attackers to hard-link or copy files into their own folders for download, potentially exposing other users' stored files and database credentials located in `config.php`.

Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics.

A reflected cross-site scripting issue exists where unauthenticated attackers can inject scripts through the `error` parameter of the 'view entry.php' endpoint. This allows attackers to send crafted links to authenticated users to steal CSRF (Cross-Site Request Forgery) tokens—which are unique identifiers used to prevent unauthorized commands—modify or delete bookings, or execute administrative actions.

Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to execute script by supplying an arbitrary type parameter that bypasses JavaScript filtering. Attackers can email an HTML attachment containing script and lure recipients to a detach.cgi link with type=text/html to run script in the victim's authenticated Usermin session.

Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ sequences in filenames, and when the recipient downloads all attachments, files like ~/.forward are overwritten, enabling command execution.

Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.

A stored cross-site scripting issue exists in the `service label` helper, which incorrectly marks unescaped OAuth service display names as `html safe`. Authenticated attackers can connect an OAuth account using a crafted nickname, name, or email and share it globally. This allows the execution of JavaScript when victims attach the account to Agents and view them. Potential impacts include the exposure of Credentials, Agents, and Events, as well as the execution of admin actions if the victim has administrator privileges.

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap id.

An authorization flaw exists in the `updateAssign()` function of the ProjectsController. This issue allows any authenticated user to reassign projects even if they lack the `can-assign-new-user-to-project` permission. Low-privileged employees can exploit this by sending PATCH or POST requests to the '/projects/updateassign/{external id}' endpoint using a specific `user assigned id` to redirect project ownership and notifications.

An authorization bypass exists in the `UpdateIssueComment` handler. Low-privileged project users, including those with the Project Viewer role, can modify comments in other projects. This is achieved by setting an issue from their own project as the parent and providing a foreign comment UID to overwrite comments they are not authorized to access.

An authorization bypass exists in the `ChangeUserOrganizationView.post` function. Authenticated users can join any organization by providing its UUID. An attacker can send a POST request to the '/app/switch organization/' endpoint to gain unauthorized access to another tenant's data and billing configuration.

Improper authentication exists in the Go event ingestion middleware. The system validates API keys using only the prefix and fails to verify the secret against the stored `hashed key`. This allows an attacker with knowledge of an API key prefix to submit usage events to the 'POST /api/track/' endpoint, enabling them to impersonate an organization and manipulate its metered usage and billing.

An incorrect authorization issue exists in the `sources/state.ts` handlers. The problem occurs because the `findFirst()` function is called without the `await` keyword, which prevents the `syncId` ownership check from executing properly. Consequently, authenticated users who possess the `syncId` of another workspace can read, overwrite, or delete its stream cursors, potentially leading to skipped data or the re-ingestion of data.

An insecure direct object reference occurs in the `get object()` function within the `SubscriptionViewSet`. The issue stems from the use of an unscoped queryset that lacks organization filtering or permission checks. Consequently, authenticated users or those with API keys from any organization can provide a `subscription id` belonging to another organization to read, cancel, update, switch plans, or modify addons, which allows for the alteration of another tenant's billing.

An authorization bypass exists in the `updateExtClient` handler. This flaw allows users with network-scoped permissions to modify external clients belonging to other networks. An attacker can send PUT requests to the '/api/extclients/{network}/{clientid}' endpoint to replace public keys, disable clients, and retrieve WireGuard private keys.

Authenticated organization users can execute arbitrary SQL by appending stacked statements to custom metric queries. This occurs when semicolon-separated SQL is submitted through the 'POST /app/metrics/' endpoint, which bypasses the validation intended to allow only the first statement. This flaw allows attackers to read or modify data across all tenants.

Authenticated organization users can perform SQL injection by registering crafted `subscription filter keys` that bypass keyword-only validation. The malicious key is rendered as an unquoted group-by identifier, allowing the injection of SQL into usage aggregation queries within the shared multi-tenant database.

A missing authorization issue exists in the customer address API, allowing unauthenticated attackers to manage addresses belonging to other customers. Attackers possessing the `customer id` and address UUIDs can perform unauthorized actions by sending POST, PATCH, or DELETE requests to the '/api/customers/:customer id/addresses' endpoint to add, modify, or delete saved shipping addresses.