Maguire Younes

**Name of the Vulnerable Software and Affected Versions** VSee Clinic version 7.1.26 VSee Clinic API version 1.3.0 **Description** Three unauthenticated endpoints expose cleartext SFTP credentials in their HTTP responses. This occurs only when SFTP connections have been configured within the application. An unauthenticated remote attacker can retrieve these credentials without authentication to gain access to the associated SFTP server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VSee Clinic version 7.1.26 VSee API version 1.3.0 **Description** An Insecure Direct Object Reference (IDOR) occurs in the '/v1.3.0/api/files' endpoint. An authenticated attacker can manipulate the `remark` request parameter to enumerate, retrieve, and delete files belonging to other users on the application server. IDOR is a type of access control flaw where an application provides direct access to objects based on user-supplied input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `remark` parameter in the '/v1.3.0/api/files' endpoint until the issue is resolved.