Witold Gorecki

**Name of the Vulnerable Software and Affected Versions** Directus versions prior to 9.16.0 **Description** The issue allows users with read access to the `password` field in `directus users` to extract argon2 password hashes by brute forcing the export functionality combined with a ` starts with` filter. This enables the enumeration of password hashes. However, taking over accounts is unlikely with current hardware unless the hashes can be reversed. **Recommendations** For versions prior to 9.16.0, upgrade to version 9.16.0 or later to patch the issue. As a temporary workaround for users unable to upgrade, ensure that no user has `read` access to the `password` field in `directus users`.

**Name of the Vulnerable Software and Affected Versions** Cloudflow (affected versions not specified) **Description** The issue allows attackers to retrieve confidential information from the system due to a Local File Inclusion vulnerability within Cloudflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cloudflow (affected versions not specified) **Description** The issue allows an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage without authentication. This is due to an unauthenticated file upload vulnerability in Cloudflow. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Directus versions prior to 9.15.0 **Description** The Directus process can be aborted by having an authorized user update the `filename disk` value to a folder and accessing that file through the "/assets" endpoint. This issue has been patched and release v9.15.0 contains the fix. Users are advised to upgrade to prevent the problem. **Recommendations** For versions prior to 9.15.0, upgrade to version 9.15.0 or later to resolve the issue. As a temporary workaround for users unable to upgrade, prevent the problem by making sure no (untrusted) non-admin users have permissions to update the `filename disk` field on `directus files`.