Unknownhad

An input validation issue in this Node.js content management system allows members to access comments for which they lack proper authorization.

An authentication bypass exists during the staff invite acceptance process. This issue allows users to specify any email address when creating their account, enabling attackers to use leaked invite tokens with email addresses they control. Additionally, legitimate recipients may register using unintended email providers.

An input validation issue exists in the comments feature. This flaw allows authenticated members to access comments they are not authorized to view, leading to the disclosure of restricted comment data.

An unauthenticated remote attacker can abuse the Stripe Checkout flow to attach a paid subscription to an existing member and modify that member's name. This process allows the injection of content into newsletters sent to the member. Depending on the email client used by the recipient, this injected content may lead to HTML injection or cross-site scripting (XSS), where malicious scripts are executed in the context of the user's browser.

Certain methods in `src/Database/FunctionsBuilder.php` allow user-controlled values to be incorporated into generated SQL as unescaped structural fragments. This can lead to SQL injection, impacting confidentiality, integrity, and availability based on the database connection privileges. The affected functions and their vulnerable parameters are: - `FunctionsBuilder::cast()`: `dataType` - `FunctionsBuilder::extract()`: `part` - `FunctionsBuilder::datePart()`: `part` - `FunctionsBuilder::dateAdd()`: `unit`

Wagtail applies ETag conditional request processing to the document serve endpoint before completing document permission and filename checks. An unauthenticated attacker who possesses a document ID and a candidate SHA1 hash can use the `If-Match` or `If-None-Match` HTTP headers to determine if that specific hash exists within the document library. This issue does not expose document contents, filenames, other metadata, or information regarding hashes unknown to the attacker.

A malicious container image can trick Podman into leaking host environment variables into the container. This occurs when an image contains an `Env` entry consisting of a key without a value. Furthermore, using an asterisk (`*`) as a glob operator allows the exfiltration of all environment variables set in the session from which the container is launched, even if their exact names are unknown.