Offensive-Ai

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0 through 11.2.x **Description** A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than `private://`. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images. **Recommendations** Update versions 0.0.0 through 10.6.13 to a newer version. Update versions 11.3.0 through 11.3.14 to a newer version. Update versions 11.4.0 through 11.4.4 to a newer version. Update versions 0.0.0 through 11.0.x to a newer version. Update versions 0.0.0 through 11.1.x to a newer version. Update versions 0.0.0 through 11.2.x to a newer version.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.0.18 **Description** The WebAuthn prepare endpoint, `/api/webauthn/prepare`, in versions prior to 4.0.18 lacks authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create an unlimited number of user accounts, even when registration is disabled. The vulnerable parameter is not specified. **Recommendations** Update to version 4.0.18 or later.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.206 **Description** FreeScout, a PHP-based help desk and shared inbox application built on the Laravel framework, contains a flaw in its file upload restrictions. Prior to version 1.8.206, the application does not prevent the upload of `.htaccess` and `.user.ini` files. On Apache servers configured with `AllowOverride All`, an authenticated user can upload a `.htaccess` file, potentially redefining file processing rules and enabling Remote Code Execution. This issue can be exploited independently or in conjunction with another issue. The vulnerable file is located at `app/Misc/Helper.php`. The `upload` functionality is affected. **Recommendations** Versions prior to 1.8.206 should be updated to version 1.8.206 or later.

**Name of the Vulnerable Software and Affected Versions** FreeScout versions prior to 1.8.206 **Description** FreeScout’s `TokenAuth` middleware generates authentication tokens using a predictable method: `MD5(user id + created at + APP KEY)`. These tokens are static and do not expire or rotate. If an attacker obtains the `APP KEY` – a common exposure vector in Laravel applications – they can compute a valid token for any user, including the administrator, leading to full account takeover without requiring a password. The `user id` and `created at` are components used in the token generation. **Recommendations** Upgrade to FreeScout version 1.8.206 or later.