Pavel Kohout

An authorization bypass exists due to an inverted boolean condition in the private-project membership check. This occurs within the clonetasks mass action handler located in htdocs/core/actions massactions.inc.php. Authenticated users who possess project creation permissions, but lack access to a specific private project, can exploit the flawed `!in array()` check to clone tasks into unauthorized private projects.

Improper input validation allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals. This occurs when values are submitted that do not match any configured option in ListSelect or ListRadio fields. By tampering with form submission payloads sent to the ajax submit endpoint, attackers can cause the `get calc value()` method to fail open and return attacker-controlled values. This enables the manipulation of payment amounts to zero or other arbitrary figures, bypassing admin-configured pricing logic.

An issue exists where client-side enforcement is used for server-side security, allowing unauthenticated attackers to bypass all form validation. This is achieved by merging attacker-controlled field metadata over server-loaded form definitions before validation occurs. By crafting a malicious AJAX request to the `nopriv` AJAX endpoint, attackers can override field types, remove required flags, and disable CAPTCHA checks. This allows the triggering of form actions, such as email notifications and database storage, using unverified content controlled by the attacker.

The Repeatable Fieldset feature contains an unauthenticated stored cross-site scripting issue. This occurs because the `parseSubmissionIndex()` function accepts arbitrary strings as submission indexes without numeric validation, and the `admin form element()` function interpolates this index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads. These scripts execute in the browser of an administrator when viewing submissions in the WordPress admin panel, potentially leading to session-cookie theft, the creation of administrator accounts, the installation of malicious plugins, and arbitrary modification of site content.

A missing authorization issue exists in the render callback of the `ninja-forms/submissions-table` Gutenberg block. Authenticated attackers with Author-level privileges can embed this block with an arbitrary `formID` in a published post to expose stored form submissions to unauthenticated visitors. By retrieving the signed bearer token injected into the visitor's browser via `wp localize script`, attackers can target the REST API submissions endpoint to access sensitive personally identifiable information, including names, email addresses, and phone numbers.

An incorrect authorization issue exists in WordPress Multisite environments. A subsite Administrator can trigger the network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check and unsafe multisite migration defaults. This is achieved by sending a crafted POST request to the 'admin-ajax.php' endpoint using the `nf delete all data` action and a per-site nonce. This process invokes migration routines that use the `switch to blog()` function to iterate through all blogs, dropping all `nf3 *` tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.

Lack of escaping in the generic image output layout leads to a Cross-Site Scripting (XSS) issue, where malicious scripts can be injected into web pages viewed by other users.

SQL injection in logical replication occurs when using the 'ALTER SUBSCRIPTION ... REFRESH PUBLICATION' command. This allows a subscriber table creator to execute arbitrary SQL using the credentials of the subscription's publication side. The execution is triggered during the subsequent `REFRESH PUBLICATION` operation.

Integer wraparound in multiple server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This can lead to arbitrary code execution as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the input provider may cause a segmentation fault, which is an error occurring when a program attempts to access a memory location that it is not allowed to access.

A read out of bounds issue exists in wolfSSHd on Windows when handling a terminal resize request. An authenticated user can trigger this condition after establishing a connection, resulting in the leakage of adjacent stack memory to the pseudo-console output.

Name of the Vulnerable Software and Affected Versions OpenSSL FIPS Module version 3.6 Description Applications utilizing AES-CFB128 encryption or decryption on systems equipped with AVX-512 and VAES support may experience an out-of-bounds read of up to 15 bytes when handling partial cipher blocks. This can lead to a denial of service if the input buffer is at a memory page boundary and the subsequent page is unmapped. The issue occurs only when processing partial blocks and on x86-64 systems with AVX-512 and VAES instruction support. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions MariaDB Server versions prior to 11.4.10 MariaDB Server versions 11.5.0 through 11.8.5 MariaDB Server versions prior to 12.2.2 Description MariaDB Server is susceptible to a crash when using the caching sha2 password authentication plugin with certain user accounts. This occurs because the `sha256 crypt r` function utilizes `alloca`, and a large packet can trigger a server crash. Recommendations Update MariaDB Server to version 11.4.10 or later. Update MariaDB Server to version 11.8.6 or later. Update MariaDB Server to version 12.2.2 or later.

A NULL pointer dereference in the mod authn socache module allows an unauthenticated remote user to crash a child process when a caching forward proxy configuration is used. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to a program crash.

A NULL pointer dereference in the `mod dav lock` module may allow an attacker to crash the server by sending a malicious request. A NULL pointer dereference occurs when a program attempts to read or write to a memory address that is NULL, typically leading to an application crash.

An issue exists in the `mod md` module where resource allocation occurs without limits or throttling when processing OCSP response data. OCSP (Online Certificate Status Protocol) is a protocol used to determine the current revocation status of a digital certificate.

The software contains a SQL injection issue within the `jwt db authorize()` function in the auth jwt module when a SQL database backend is used and db mode is enabled. The function incorporates a tag claim from a JWT directly into a SQL query without verifying the signature first. An attacker can craft a malicious JWT with a specially designed tag claim to manipulate the query and bypass authentication, potentially impersonating other users.

The Espressif Internet of Things (IOT) Development Framework contains a flaw in the WPS (Wi-Fi Protected Setup) Enrollee implementation. Malformed EAP-WSC packets with truncated payloads can trigger an integer underflow during fragment length calculation. Specifically, when processing EAP-Expanded (WSC) messages, the code calculates `frag len` by subtracting header sizes from the total packet length. An attacker can send a packet where the EAP Length field only covers the header and flags, omitting the expected payload. This causes `frag len` to become negative, which is then implicitly cast to a size t value when passed to the `wpabuf put data()` function, resulting in a large unsigned value.

MuPDF versions 1.23.0 through 1.27.0 have a double-free issue in the `fz fill pixmap from display list()` function during display list rendering. This occurs when an exception happens, causing the function to incorrectly release a pixmap pointer in its error handling before re-throwing the exception. Subsequent cleanup by callers, including the barcode decoding path in `fz decode barcode from display list()`, also releases the same pixmap, leading to a double-free. This can corrupt the heap and cause the process to crash. The issue impacts applications using MuPDF barcode decoding and can be triggered by specially crafted input that causes a rendering error during barcode decoding.

NATS-Server, a high-performance messaging system, has an issue in its WebSocket implementation. The server handles compressed messages via WebSocket negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation only bounded the size of a NATS message but did not independently bound the memory consumption during message construction. This allows an attacker to use a compression bomb, causing excessive memory consumption and potentially terminating the server process. The issue does not require valid NATS credentials to exploit, as compression negotiation occurs before authentication.

ESF-IDF, the Espressif Internet of Things (IOT) Development Framework, contains a flaw in the `avrc vendor msg()` function within the BlueDroid AVRCP stack. The function validates the allocated buffer size using `AVRC MIN CMD LEN` (20 bytes), but the fixed header data written before the vendor payload exceeds this value, totaling 29 bytes before `p msg->p vendor data` is copied. This discrepancy can lead to an out-of-bounds write when `vendor len` approaches the buffer limit, potentially causing memory corruption, crashes, or undefined behavior. The overflow may be larger when assertions are disabled.