CVE Vulnerability Catalog

Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. A low-privileged user who controls one colliding folder and knows the target basename can alter the metadata, make the victim file appear attacker-owned, then read and modify it.

Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and password can upload a file with the same name and silently replace its content while the original uploader metadata remains. The same gap affects ordinary authenticated uploads via /api/upload/upload.php and authenticated upload-only users lacking edit authority.

Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account. The application lacked a durable setup-complete marker independent of the mutable user store.

Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not.

Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend.

In OpenSIPS up to 3.6.8/4.0.1, the rtpproxy_offer/rtpproxy_answer function of the rtpproxy component causes an out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 or 4.0.2 resolves the issue.

A SQL injection vulnerability was found in cemtan sar2html 4.0.0, in the updateDb function of sar2html.py within the Archive Processing component. Manipulation of the s2host argument allows SQL injection. The attack can be launched remotely.

Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker able to obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled.

Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit.

A post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in SonicWall Network Security Manager (NSM) on-prem. Under specific conditions, a remote authenticated attacker could execute arbitrary OS commands, resulting in remote code execution.

Prior to 3.8.6, WeGIA's auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute.

Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables, allowing arbitrary SQL execution.

In InvoiceShelf version 2.3.3 and earlier, bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. An authenticated user can submit another company's identifier and delete cross-company records.

Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can enter the ORDER BY clause, enabling boolean-based blind extraction of database information.

Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes.

Prior to version 2.4.0, InvoiceShelf NotesController::show, update, and destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy, so neither method checks the target note's company_id. An authenticated staff user can read, modify, or delete another company's note templates.

Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. An authenticated user can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in their own company.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.30 does not validate the command value or arguments sent from the webview. JavaScript running in the preview can invoke privileged extension commands, including file modification, code execution, export-tool execution, and arbitrary URL opening. Exploitation requires a separate webview JavaScript execution path, such as the .crossnote/head.html injection.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.29 evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing OS command execution as the victim account without further interaction.

In cemtan sar2html 4.0.0, the index function in sar2html.py does not properly sanitize the sort argument, leading to SQL injection. The attack can be carried out remotely, and a public exploit is available that could be used in attacks. The project was informed of the issue but has not responded.