Michael Holmquist

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the from pretrained() method and related paths. When loading a policy's processor configuration from a repository, the library uses the class field within the JSON configuration to dynamically resolve and instantiate Python classes using importlib.import module() and getattr().

An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication (2FA) indefinitely. By submitting a crafted POST request that omits the `two-factor-authentication` field, an attacker can skip nonce verification and trigger the `delete two fa meta()` function. This action resets the grace period anchor timestamp during every login cycle, which defers the mandatory 2FA enforcement.

Authenticated users can publish content into other tenants' namespaces because the system fails to authorize callers against the workspace in the bulk publish endpoint path. This allows attackers to write published views with controlled title, body, and metadata into victim workspaces, which can be used to deface public pages or host phishing content on trusted URLs.

An out-of-bounds write occurs in the `NC4 HDF5 inq attname()` function when processing HDF5 files. The issue arises because HDF5 attribute names are copied into a fixed 256-byte buffer without proper length validation. An attacker can use a specially crafted HDF5 file with oversized attribute names to overflow the destination buffer, leading to memory corruption and application crashes during the enumeration of attribute names.

ModelScope uses PyYAML's unsafe `yaml.Loader` to parse model configuration files. This allows arbitrary code execution through Python object construction tags, enabling attackers to craft malicious model repositories with poisoned configuration files that execute code when loaded by users.

The software fails to revoke refresh tokens when a user changes their password, which allows unauthorized parties to maintain account access. An attacker possessing a stolen refresh token can call the `RefreshToken` RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the security measure intended to terminate sessions upon a password change.

Authenticated users can retrieve group memberships of other users because the software fails to perform per-object authorization checks. By calling the 'GET /users/{id}/groups' API endpoint with arbitrary `id` values, an attacker can access group names, entity associations, and private notes across tenant boundaries.

An authorization flaw exists in the '/render jinja template' endpoint. Low-privileged users can render arbitrary Jinja templates by providing raw template strings. This allows attackers who possess print permissions on any document to execute arbitrary SELECT statements against unrelated tables, which can lead to the exposure of password hashes from the ` Auth` table.

An incorrect authorization check in the REST API allows authenticated users to delete documents using insufficient permissions. The `Documents::delete()` function in `htdocs/api/class/api documents.class.php` calls `dol check secure access document()` using the `read` mode instead of the `write` mode when processing the `DELETE /api/index.php/documents` endpoint. Consequently, a user with only read permissions for a module (such as `societe:lire` or `facture:lire`) can permanently delete files, including invoices, orders, proposals, project files, and generated PDFs, without having create, write, delete, or admin privileges.

The software saves inbound email attachments using the name provided in the message's MIME headers without properly sanitizing it to a safe basename. This occurs within the global `saveAttachment()` function in htdocs/emailcollector/lib/emailcollector.lib.php, which constructs `$filepath` using `$path`, `$filename`, and `$ext` before passing it to `file put contents()`, and the private `saveAttachment()` function in htdocs/emailcollector/class/emailcollector.class.php, which writes to `$destdir` using `$filename`. These values are derived from the attachment's `getName()` or `getFilename()` during record-join, create-ticket, and create-project operations. An attacker can include a traversal sequence in the filename to place controlled content outside the intended attachment directory without requiring an account. If the htdocs directory is read-only, the impact is limited to the documents tree, potentially corrupting or forging other objects' documents. However, if htdocs is writable, the attacker can write files to a web-executable path.

The software stores and renders workspace card descriptions without Cross-Site Scripting (XSS) filtering. This occurs because the description field of the Workspace Link doctype is configured to ignore XSS filters, causing the ` sanitize content()` function in `frappe/model/base document.py` to store the submitted value without sanitization. Subsequently, the `LinksWidget.set body()` function in `frappe/public/js/frappe/widgets/links widget.js` interpolates this content into a Bootstrap popover without HTML escaping. A user with the Workspace Manager role can inject arbitrary markup into a public workspace card description. This markup executes in the session of any user who hovers over the description, potentially allowing session token theft and unauthorized authenticated requests.

An out-of-bounds read and write occurs when the software subscripts its layer array using an index from a configuration file without verifying it against the array length. The array is allocated in `src-lib/darknet network.cpp` based on the number of layer sections declared. Specifically, the `from` field in shortcut, scale channels, and sam sections, and the `layers` field in the route section, provide indices that are used in `parse shortcut section` within `src-lib/darknet cfg.cpp` to read `net.layers[index].outputs` without bounds checking. Subsequently, the dispatch loop in `create network` uses the same index to assign values to `net.layers[l.index].use bin output` and `net.layers[l.index].keep delta gpu`, resulting in a write operation past the allocation. Processing a specially crafted configuration file can lead to a reliable system crash.

Baserow fails to act on the result of a permission check when dispatching an Application Builder data source. The dispatch and record-name views in `backend/src/baserow/contrib/builder/api/data sources/views.py` use a permission class that allows any caller, enabling unauthenticated requests to reach the handler. Subsequently, the `DataSourceService.dispatch data sources` function in `backend/src/baserow/contrib/builder/data sources/service.py` calls `check multiple permissions()` without requiring it to raise an exception and ignores the returned mapping of denials. Consequently, the data source is dispatched using the integration's own credentials regardless of the caller's identity, allowing unauthenticated users to retrieve rows and fields by enumerating small integer identifiers.

A SQL injection exists in the CSV and XLSX import wizard. The issue occurs because the wizard reads update keys using the `GETPOST('updatekeys','array')` function in `htdocs/imports/import.php`, applying only a filter that removes HTML while leaving SQL keywords, quotes, and parentheses intact. Subsequently, the `import insert()` function in `htdocs/core/modules/import/import csv.modules.php` builds a filter where the `$where[]` variable is constructed using the submitted keys without proper validation against a legitimate list of column codes. This allows a user with import permissions to use a `UNION SELECT` statement to exfiltrate arbitrary table content or redirect which row is overwritten during an update. The vulnerability is triggered when the assembled string is executed via `$this->db->query()`.

The software instantiates classes based on a configuration file without restricting which classes can be named. The `instantiate class` function in `vocos/pretrained.py` uses the `class path` value from the configuration to import a module via ` import ` and resolve an attribute using `getattr`, subsequently calling the result as `args class(*args, **kwargs)` with arguments from the `init args` mapping. Because there is no allowlist to constrain the dotted path, a configuration file can specify any importable callable and its arguments. This issue is reachable through `Vocos.from hparams` for `feature extractor`, `backbone`, and `head` entries, as well as through `Vocos.from pretrained`, which downloads a `config.yaml` from a specified Hugging Face repository. Consequently, loading a model from an untrusted repository allows the repository owner to execute arbitrary code during the loading process.

An issue exists in the `security.http.urls` allowlist which serves as the sole control for outbound fetches performed by `resources.GetRemote`. The `CheckAllowedHTTPURL` function in `config/security/securityConfig.go` validates the URL text and canonicalized IPv4 hosts but fails to resolve hostnames or inspect the actual destination address the HTTP client connects to. Additionally, the client in `resources/resource factories/create/create.go` lacks a dial-time hook, meaning no validation occurs during the connection phase. Consequently, a hostname resolving to a loopback, private, or cloud-metadata address can bypass the policy. An attacker capable of providing a URL through content, such as a CMS field or front-matter field, can force the build process to fetch data from an internal endpoint and include the response in the static output, leading to Server-Side Request Forgery (SSRF).

The default fenced-code-block renderer fails to escape attribute values derived from the code-fence info string when writing them to the rendered HTML. This occurs because the `New` function in `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings, bypassing the escaping process. Subsequently, the `RenderAttributes()` function only escapes values that remain as byte slices, meaning string values are written verbatim. An attacker can use a quote within an attribute value to terminate the attribute and inject additional attributes, such as event handlers, into the wrapper element, leading to stored Cross-Site Scripting (XSS). This issue is present in the default configuration when code fences are enabled, regardless of the goldmark unsafe setting or custom render hooks. While attribute names starting with `on` are filtered during parsing, injection is still possible via the attribute value.

Windows clipboard redirection fails to perform an upper bound check when copying a peer-supplied length into a fixed-size caller buffer. When an OLE paste consumer, such as explorer.exe, calls `IStream::Read` with a buffer of `cb` bytes, the `CliprdrStream Read` function in `libs/clipboard/src/windows/wf cliprdr.c` requests data via `cliprdr send request filecontents` and executes `CopyMemory(pv, clipboard->req fdata, clipboard->req fsize)`. The `req fsize` variable is taken directly from the peer's CLIPRDR FileContentsResponse via `wf cliprdr server file contents response` and is not clamped to `cb`. Because the length comparison `req fsize < cb` occurs after the copy operation, a malicious peer can send an oversized response to write arbitrary data past the end of the paste consumer's heap buffer when a local user pastes clipboard file contents from a remote side.

An issue exists in the `flair/models/clustering.py` file where the `ClusteringModel.load()` static method uses `pickle.loads()` on a file loaded via `joblib.load()`. This allows for the execution of arbitrary Python code when a maliciously crafted model file is loaded, granting the attacker the privileges of the process performing the load.