Saku0512

**Name of the Vulnerable Software and Affected Versions** Nuxt versions 4.4.7 through 4.5.0 Nuxt versions 3.21.7 through 3.21.9 **Description** An information disclosure issue exists in the development server's Chrome DevTools workspace endpoint 'GET /.well-known/appspecific/com.chrome.devtools.json'. The local-request gate `isLocalDevRequest()` relies on the Host header instead of the connected peer address. If the development server is bound to a network-reachable interface and `experimental.chromeDevtoolsProjectSettings` is enabled, an unauthenticated attacker on the local network can spoof the Host header to retrieve the project's absolute filesystem root path `rootDir` and a persistent per-project workspace UUID. **Recommendations** Update to version 4.5.1 or later. Update to version 3.21.10 or later. Disable the `experimental.chromeDevtoolsProjectSettings` setting to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An issue exists where a remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, can bypass client Uniform Resource Identifier (URI) validation. By registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme, the attacker can trigger Cross-Site Scripting (XSS), which is a technique used to inject malicious scripts into web pages. This allows for arbitrary code execution in the Keycloak origin when a victim clicks the crafted link, such as during the logout flow or within the Admin Console. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.6 **Description** The Hook Authentication feature allows administrators to delegate login verification to an external shell command. User-supplied credentials, specifically the `username` and `password` variables, are interpolated into this command string using `os.Expand` without proper sanitization. An unauthenticated remote attacker can inject shell metacharacters into these fields at the login screen, leading to remote code execution (RCE) where the server executes arbitrary OS commands before authentication occurs. **Recommendations** Update to version 2.63.6. As a temporary workaround, consider disabling the Hook Authentication feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** go-chi chi versions 5.2.1 through 5.2.9 **Description** The RealIP middleware blindly trusts the first (leftmost) value of the `X-Forwarded-For` HTTP header. This allows a remote attacker to supply a spoofed IP address in the `X-Forwarded-For` header to bypass rate-limiting mechanisms and IP-based access control lists, as well as to forge log entries. **Recommendations** Update go-chi chi to version 5.3.0.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 3.6.21 Traefik versions prior to 3.7.5 **Description** An issue exists in the Kubernetes Gateway provider regarding the `crossProviderNamespaces` allowlist. When `HTTPRoute` rules declare multiple backendRefs (Weighted Round Robin), the system evaluates the allowlist against the target `backendRef.namespace` instead of the namespace of the route itself. This allows an `HTTPRoute` created in a non-allow-listed namespace to reference internal cross-provider `TraefikService` components, such as `api@internal`, `dashboard@internal`, or `rest@internal`, by pointing the `backendRef.namespace` to an allow-listed namespace that has a matching Gateway API `ReferenceGrant`. This results in the exposure of internal Traefik services on the data plane. Exploitation requires the ability to create an accepted `HTTPRoute` and a corresponding `ReferenceGrant` from an allow-listed namespace. **Recommendations** Update to version 3.6.21. Update to version 3.7.5.

**Name of the Vulnerable Software and Affected Versions** File Browser versions 2.0.0 through 2.33.8 **Description** The hook system in File Browser, which executes administrator-defined shell commands during file events such as upload, rename, and delete, is susceptible to OS command injection. The issue occurs in the `Runner.exec()` function within the `runner/runner.go` file, where variable substitution for values like `$FILE` and `$USERNAME` is performed using `os.Expand` without proper sanitization. An authenticated attacker with file write permissions can craft a malicious filename containing shell metacharacters. When the hook fires, the server executes these characters as arbitrary OS commands, leading to Remote Code Execution (RCE). This pattern is exploitable across various hook events, including `before upload`, `after upload`, `before rename`, `after rename`, `before delete`, and `after delete`. **Recommendations** Update to version 2.33.8 or later, as the hook feature is disabled by default from this version onwards. As a temporary workaround, disable the hook system or restrict the use of the `Runner.exec()` function until the software is updated.