Tulgaaaaaaaa

The terminal-server reverse proxy in `backend/open webui/routers/terminals.py` fails to properly confine the user-controlled `path` segment before forwarding it to an admin-configured terminal server. An authenticated user with terminal server access can use encoded `../` traversal sequences to escape the intended path or policy scope, allowing access to unintended files and endpoints on the terminal-server host. If the terminal server forwards requests to internal services, this can lead to Server-Side Request Forgery (SSRF), where the server is induced to make requests to internal resources. Two vectors were identified: raw path forwarding using single-encoded traversal and a bypass of the ` sanitize proxy path` function using double-encoded dots (`%252e%252e`).

NocoDB is software for building databases as spreadsheets. The password forgot endpoint returns different responses for registered and unregistered emails, allowing user enumeration. The `/forgot-password` API endpoint is affected. The `email` parameter is used in the request.

NocoDB is software for building databases as spreadsheets. Shared view passwords were stored in plaintext in the database and compared using direct string equality. This could allow unauthorized access to shared views.