Wooseokdotkim

An authorization bypass occurs because session tokens skip scope validation within the `RequireScopes` middleware. This allows authenticated users without administrative privileges to access administrative endpoints. By providing authenticated session tokens, attackers can retrieve system logs, visitor statistics, and user emails, as well as subscribe to live WebSocket logs.

A low-privileged authenticated user with create and delete permissions in their own isolated scope can delete share-link records belonging to any other user, including the administrator. This occurs when the user performs a DELETE operation on a file in their own directory whose logical path is a byte-prefix of another user's stored `share.Link.Path`. The issue resides in the `resourceDeleteHandler` function within `http/resource.go`, which calls `DeleteWithPathPrefix()` without verifying the ownership of the share records being deleted. While the contents of the victim's files are not exposed, the share links are irrevocably wiped, potentially leading to a denial-of-service of the share-link feature.

Insufficient escaping of user-provided descriptions for generic offline causes allows for stored cross-site scripting (XSS), where malicious scripts are permanently stored on the server and executed in the browser of other users. This issue is exploitable by attackers possessing Agent/Configure permissions via the 'POST config.xml' API endpoint.

A technician can delete arbitrary files from the filesystem, provided the webserver has write permissions for those files.

Insufficient HTML sanitization allows for Cascading Style Sheets (CSS) injection. This occurs when an SVG document contains an `animate` element utilizing the `attributeName` attribute.

Dag Authors can craft a malicious XCom payload that allows them to execute arbitrary code within the webserver context, bypassing the standard restriction that prevents them from executing code in that environment.

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.1 Description prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address containing raw HTML that is accepted as valid by PHP's FILTER VALIDATE EMAIL function. This email is stored in the database without sanitization and rendered in the admin FAQ editor template using Twig's |raw filter, bypassing auto-escaping. This allows for the execution of arbitrary scripts in the administrator's browser when reviewing the FAQ, potentially leading to session cookie theft and full admin account takeover. Recommendations Update to version 4.1.1 or later.

A security issue exists in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller and the disclosure of Secrets accessible to the controller. In a default installation, the controller has access to all Secrets cluster-wide. An estimated 100k–1M+ environments globally may be affected, particularly enterprise and cloud setups. Exploitation requires low-privilege Kubernetes API access (e.g., the ability to create Ingress resources). The vulnerability allows attackers to inject malicious nginx configuration via annotation combinations, potentially leading to remote code execution (RCE). The `ingress-nginx` controller is vulnerable to configuration injection through specially crafted Ingress annotations. Attackers can leverage this to execute arbitrary code within the controller's context and potentially access sensitive information, including cluster Secrets.

An out-of-bounds array write issue exists in Xpdf due to insufficient validation of the "N" field within ICCBased color spaces. This can lead to a crash or potentially allow for arbitrary code execution.

GPAC is an open-source multimedia framework. A stack buffer overflow occurs during NHML file parsing in `src/filters/dmx nhml.c`. The `xmlHeaderEnd` XML attribute’s value from `att->value` is copied into the `szXmlHeaderEnd` buffer (size 1000 bytes) using the `strcpy()` function without length validation. If the input exceeds 1000 bytes, it overwrites the stack buffer boundary.

An incomplete fix allows bypassing of intended write restrictions when using the Permission Model with restricted `--allow-fs-write`. Specifically, the `FileHandle.chmod()` and `FileHandle.chown()` methods within the promises API lack the necessary permission checks, while their callback-based counterparts (`fs.fchmod()`, `fs.fchown()`) were patched correctly. This allows code running with restricted permissions to modify file permissions and ownership on already-open file descriptors. The vulnerable API endpoints are `FileHandle.chmod()` and `FileHandle.chown()`. The vulnerable variables are file permissions and ownership.

An incomplete fix allows for a potential out-of-bounds read within the `gst wavparse adtl chunk()` function. The initial patch included a size validation check, however, it did not fully account for the offset calculation using `GST ROUND UP 2(lsize)`. Specifically, when `lsize` is an odd number, the parser can advance beyond the validated boundaries, leading to an out-of-bounds read.

FreeRDP is an implementation of the Remote Desktop Protocol. The `gdi surface bits()` function handles SURFACE BITS COMMAND messages from the RDP server. When using NSCodec, the `bmp.width` and `bmp.height` values are not validated against desktop dimensions. A malicious RDP server can send crafted `bmp.width` and `bmp.height` values exceeding the expected surface size. This can lead to a heap buffer overflow because these values are used during bitmap decoding and memory operations without proper bounds checking. An attacker controlling the pixel data can potentially overwrite adjacent heap memory.