Proscan-One

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.05.1 **Description** The shared-view password check used strict-equality (===) comparison for legacy plaintext passwords. This creates a timing oracle, allowing a network-positioned attacker to leak the password length and per-character prefix by analyzing response timing. The issue occurs in the `View.ts` file and the `verifyPassword()` function of the EE dashboard model. The bcrypt branch, which handles hashes starting with `$2a$` or `$2b$`, is not affected. **Recommendations** Update to version 2026.05.1.

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions 2.71.11 through 2.71.19 ZITADEL versions 3.1.0 through 3.4.9 ZITADEL versions 4.0.0 through 4.14.0 **Description** An issue exists in the LDAP identity provider implementation where user-provided usernames are not properly escaped before being included in LDAP search filters. This allows unauthenticated attackers to perform LDAP Filter Injection during the login process. By using LDAP metacharacters such as `*`, `(`, and `)`, an attacker can execute blind LDAP injection. This technique enables the systematic enumeration of valid usernames and the extraction of sensitive attribute data from the connected LDAP directory by analyzing the success or failure responses. This does not allow for a full authentication bypass. **Recommendations** Update versions 2.71.11 through 2.71.19 to 3.4.10. Update versions 3.1.0 through 3.4.9 to 3.4.10. Update versions 4.0.0 through 4.14.0 to 4.15.0. Ensure the LDAP directory has strict access controls to limit the scope of information disclosure.

**Name of the Vulnerable Software and Affected Versions** Grav CMS versions prior to 2.0.0-beta.2 **Description** Multiple issues allow for code execution. Three unsafe `unserialize()` calls within `SchedulerJobQueue`, `FrameworkCacheAdapterFileCache`, and `Session` deserialize untrusted data without restricting allowed classes. This enables PHP object injection which, through a gadget chain, allows arbitrary code execution when an attacker controls the serialized input. Additionally, the `InstallCommand` function performs a git clone operation that passes the `branch`, `url`, and `path` parameters into a shell command without escaping, leading to OS command injection during plugin or theme installation for users with admin access. A server-side template injection is also possible via a Twig security blocklist bypass. **Recommendations** Update to version 2.0.0-beta.2.

**Name of the Vulnerable Software and Affected Versions** Portainer Community Edition versions 2.33.0 through 2.33.7 Portainer Community Edition versions 2.39.0 through 2.39.1 Portainer Community Edition versions prior to 2.41.0 **Description** Portainer includes a security setting to disable bind mounts for non-administrators, intended to prevent regular users from binding host paths into containers via the Portainer-mediated Docker API. However, the enforcement mechanism only inspected the `HostConfig.Binds` array and ignored the equivalent `HostConfig.Mounts` array. Since both fields are interchangeable on the Docker daemon, an authenticated user with container-creation rights can bypass this restriction by submitting a `bind`-typed entry under `HostConfig.Mounts` at the 'POST /containers/create' endpoint. This allows the user to mount any host path into their container, potentially gaining read or write access to the host filesystem as the Docker daemon user (typically `root`). This can lead to the exposure of sensitive files, compromise of other containers on the same host, or full Docker API access if the Docker socket is mounted. **Recommendations** Update Portainer Community Edition versions 2.33.0 through 2.33.7 to 2.33.8. Update Portainer Community Edition versions 2.39.0 through 2.39.1 to 2.39.2. Update Portainer Community Edition versions prior to 2.41.0 to 2.41.0. Revoke container-create rights from non-administrator accounts on affected environments. Segregate tenants by environment to provide stronger control than the bind-mount toggle.