Rmb122

A path traversal issue exists in the SQL result-editing functionality. This allows an authenticated user with SQL result-editing privileges to force the server to open files outside the designated temporary upload directory. In specific database value-handling scenarios, this can lead to the disclosure of local files that are readable by the CloudBeaver server process.

The icon downloader fails to apply the `should block host()` check to the second-stage host when processing favicon URLs parsed from attacker-controlled HTML passed to `get page with referer()`. This allows a remote unauthenticated attacker to use an IP-literal URL in a favicon to bypass host normalization and force the server to reach loopback, private, or internal addresses. This issue occurs on instances where internal icon downloading is enabled and can lead to the exposure of internal responses or reveal internal network reachability through timing, status, and cache behavior.

The `/api/v1/teams/{id}` API routes fail to correctly enforce the `public-only` access token restriction. A `public-only` token is designed to limit API access to public repositories and organizations; however, these routes may return private team repository metadata and private team activity feed entries. This occurs because the `checkTokenPublicOnly` middleware fails to verify organization visibility when `ctx.Org.Organization` is nil. Additionally, team repository handlers do not apply repository-level filtering via `ctx.TokenCanAccessRepo(repo)`, and the team activity feed handler fails to apply `opts.ApplyPublicOnly(ctx.PublicOnly)` while having `IncludePrivate` set to true.

Nagios Network Analyzer contains a flaw in how it handles LDAP certificate management. Specifically, the certificate removal process does not properly sanitize input. An authenticated administrator can exploit this to execute commands on the host system, with the privileges of the web application service, leading to remote code execution.

The issue is caused by the misuse of `log.Fatalf` in the OWASP Coraza WAF library, which leads to the application crashing after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`.

The issue allows arbitrary file download without authentication via "/downloads/.." directory traversal because `os.path.join` is misused. This can be exploited through the "/downloads/" API endpoint.