Pyuysig

In OpenID multi-user mode, disabling a user only prevents future OpenID logins for that identity. Existing session tokens remain valid because the shared session validation path does not check if the associated user is still enabled. This allows a disabled user to continue accessing authenticated server endpoints. The issue is particularly persistent in default deployments where the `token expiration` variable is set to `never`. A disabled user can maintain access to their own budgets, shared budgets containing sensitive financial data, or even administrative privileges if the disabled account had an admin role. The vulnerability involves the `validateSession()` function and affects endpoints protected by `validateSessionMiddleware`, such as the sync API and the `/users` update route via the `enabled` variable.

Kestra is an open-source, event-driven orchestration platform. The `inputFiles` task writes rendered file names directly under the task working directory. If a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside the task working directory on the worker filesystem. This is a path traversal issue, where `../` sequences are used to access and manipulate files and directories outside the intended folder.

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request.

An authenticated Server-Side Request Forgery (SSRF) exists in the custom scraper subsystem component. This allows attackers to scan internal resources by supplying a crafted URL. SSRF is a flaw where a server is tricked into making requests to an unintended location, often bypassing network security controls.

An input handling flaw in the HTTP refresh token process allows attackers to cause a Denial of Service (DoS), which is a condition where a service becomes unavailable to its intended users, by sending a crafted `refresh-token` header.

SQL injection occurs at the '/stockreports/spendings' endpoint through the `product-group` parameter. This allows attackers to access sensitive database information by using a crafted SQL statement. SQL injection is a type of flaw where an attacker can interfere with the queries that an application makes to its database.

Incorrect access control in the '/admin/api/config' endpoint allows attackers to escalate privileges by sending a crafted request.

Incorrect access control in the "Let's Encrypt" certificate download endpoint allows authenticated attackers to obtain TLS private key material by sending a crafted GET request.

The ClickHouse sink contains a SQL/identifier injection flaw. The software escaped the `table` identifier but interpolated the `database` value raw into the INSERT statement, allowing a crafted database value to break out of identifier quoting. This occurs in the `KeyPartitioner::partition()` function via the `set uri query` parameter, which could allow attackers to access sensitive database information using crafted SQL statements.

An issue in the '/util/http/prelude.rs' endpoint allows attackers to cause a Denial of Service (DoS), which is a condition where a service becomes unavailable to its intended users, by sending a crafted request or payload.

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

An information disclosure issue in the configuration endpoint allows attackers to obtain sensitive information by sending a crafted GET request.

An OS command injection flaw exists in the media archiving and export pipeline component. This allows attackers to execute arbitrary commands on the operating system by providing a specially crafted input.

An issue in the loopback request handling component allows attackers to execute arbitrary commands and obtain sensitive information by supplying a crafted HTTP request.

An arbitrary file upload issue exists in the attachment handling component. This allows attackers to execute arbitrary code by uploading a specially crafted HTML or SVG file.

An OS command injection allows attackers to execute arbitrary commands by supplying crafted input to the '/manage/features/media' endpoint. OS command injection is a flaw where an application executes system-level commands provided by a user.

Incorrect access control in the "/{form}/webhooks/{webhook}" endpoint allows authenticated attackers to arbitrarily modify or delete webhooks belonging to other tenants by sending a crafted request.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML through the use of a crafted payload.

A directory traversal issue exists where attackers can execute the traversal by supplying files with names containing traversal characters. Directory traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder.

A flaw in the `uploadPostHandler` component allows remote attackers to trigger a Denial of Service (DoS) by sending a specially crafted POST request.