Ppfeister

**Name of the Vulnerable Software and Affected Versions** Sync-in Server versions prior to 2.2.0 **Description** A logic flaw in the "/api/auth/login" endpoint allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This timing discrepancy occurs because the application responds faster when a username does not exist compared to when a valid username is provided, as the backend short-circuits the process when no matching user is found. **Recommendations** Update to version 2.2.0.

**Name of the Vulnerable Software and Affected Versions** qui versions 1.14.1 and below **Description** qui, a web interface for managing qBittorrent instances, has a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true. This allows any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which can silently interact with the application using the victim's session. This could lead to the exfiltration of sensitive data such as API keys and account credentials, or even full system compromise through the built-in External Programs manager. Exploitation requires the victim to access the application via a non-localhost hostname and load an attacker-controlled webpage, making highly targeted social-engineering attacks the most likely scenario. The application connects to and authenticates with several outside websites and related services, potentially exposing credentials saved by the application. Successful exploitation may lead to a compromise of the host or container, depending on the installation type, in the user-context of the application. **Recommendations** Update to a newer version of qui that addresses this issue.

**Name of the Vulnerable Software and Affected Versions** Cleanuparr versions 2.7.0 through 2.8.0 **Description** Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. The `/api/auth/login` endpoint has a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. The hashing function, which is the most time-consuming part of the process, occurs as part of the `VerifyPassword` function. Short circuits occurring before the hashing function introduce a timing differential that exposes validity to the attacker. **Recommendations** Cleanuparr versions 2.7.0 through 2.8.0 should be updated to version 2.8.1.

**Name of the Vulnerable Software and Affected Versions** Dumb Drop (affected versions not specified) **Description** The issue concerns a path traversal vulnerability in the Dumb Drop file upload application. Users with permission to upload to the service can exploit this vulnerability to overwrite arbitrary system files. Since the container runs as root by default, there is no limit to what can be overwritten. This allows for the injection of malicious payloads into files that are run on schedule or upon certain service actions. If the service is not required to run with authentication enabled, this may permit wholly unprivileged users root access, or otherwise, access for anybody with a PIN. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zusam versions prior to 0.5.6 **Description** The issue allows for unrestricted script execution on image load when specially crafted SVG files are uploaded to the service. This can lead to the theft of a target user's long-lived session token, which remains valid indefinitely unless the user requests a new one. The session token is used interchangeably with the user's static API key on the platform. **Recommendations** For versions prior to 0.5.6, update to version 0.5.6 to fix the cross-site scripting vulnerability. As a temporary workaround, consider restricting the upload of SVG files to minimize the risk of exploitation.