Shukla304

An authenticated Subsonic user can bypass ownership checks to read or delete playlists belonging to other users and probe arbitrary file paths on the host for existence or readability. This occurs because the `playlist.UserID` is derived from the first path segment of the playlist ID, but there is no path containment on the resolved file path. The issue involves path traversal within the `id` parameter, allowing a bypass of the boundary intended to prevent insecure direct object references (IDOR), which is a vulnerability where an application provides direct access to objects based on user-supplied input.

An authenticated user can upload attachments to private issues that they are not authorized to access.

A bugnote author can access the Revisions page of a note even after losing access to the parent private issue. This leads to the disclosure of the private issue's ID and summary, although the full revision body of the bugnote remains secure.

A CMS user with limited access to form pages can delete submissions for pages they are not authorized to access. This is achieved by crafting a form submission to delete entries on a page they can access, but targeting submissions from pages they cannot. This issue is not exploitable by ordinary site visitors who lack access to the Wagtail admin.

The backend `conversation change customer` action fails to properly validate the `customer email` variable. While the Change Customer modal filters out-of-scope customers via the mailbox-filtered search endpoint, a low-privileged agent can forge a request to bind a visible conversation to a hidden customer in another mailbox.

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.212 Description FreeScout, a help desk and shared inbox built with PHP's Laravel framework, does not properly consider the `limit user customer visibility` parameter when merging customers in versions prior to 1.8.212. Recommendations Update to version 1.8.212 or later.

Mantis Bug Tracker is an open source issue tracker. A flaw exists in version 2.28.0 where improper escaping of a tag name during the display of a confirmation message when deleting a tag (via the `tag delete.php` script) allows an attacker to inject HTML. If Content Security Policy (CSP) settings permit, this can lead to the execution of arbitrary JavaScript. The vulnerable parameter is the tag name displayed in the confirmation message.

Mantis Bug Tracker version 2.28.0 contains a flaw due to improper escaping of tag names retrieved from History in the Timeline feature, specifically within the `my view page.php` file. This allows an attacker to inject HTML code. If Content Security Policy (CSP) settings allow, this can lead to the execution of arbitrary JavaScript when displaying a tag that has been renamed or deleted. The vulnerable variable is `$this->tag name` within the `IssueTagTimelineEvent::html()` function.