CVE Vulnerability Catalog

An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings. A remote authenticated attacker could obtain sensitive information, potentially escalating privileges to administrator or intercepting communications of other NSM instance users.

FileRise is a self-hosted web-based file manager. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. This issue is fixed in version 3.22.0.

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the /api/player/** lessons endpoints can be called without authentication, and they trust a client-supplied userId query parameter without verifying that the caller is that user or a member of the exercise. An unauthenticated client that knows an exercise UUID can read lessons-learned questions and answers (including each answer's author identity) and create or overwrite answers attributed to an arbitrary user. Version 2.260622.0 contains a patch.

FileRise is a self-hosted web-based file manager. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API without server-side sanitization. The FileRise frontend already sanitizes this value before rendering it into the page, but the unauthenticated public config API exposed raw admin-provided footer HTML to clients. An administrator must first store the malicious footer value. This issue is fixed in version 3.21.0.

FileRise is a self-hosted web-based file manager. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account attempt budget for each name, enabling password spraying from one source beyond the intended limit. This issue is fixed in version 3.21.0.

FileRise is a self-hosted web-based file manager. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the corresponding server-side authentication flows. A user with otherwise valid credentials for a disabled method can call its backend endpoint directly and authenticate despite the administrator's login-method policy. This issue is fixed in version 3.21.0.

Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling.

FileRise prior to 3.19.0 does not reject dot-dot path segments in the folderName string before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR.

Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. A low-privileged user who controls one colliding folder and knows the target basename can alter the metadata, make the victim file appear attacker-owned, then read and modify it.

Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and password can upload a file with the same name and silently replace its content while the original uploader metadata remains. The same gap affects ordinary authenticated uploads via /api/upload/upload.php and authenticated upload-only users lacking edit authority.

FileRise prior to 3.16.0 stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token.

Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account. The application lacked a durable setup-complete marker independent of the mutable user store.

FileRise prior to 3.16.0 does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename.

Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not.

Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend.

A vulnerability has been found in OAID Tengine up to 1.12.0 affecting the function get_tm_file_model in source/serializer/tmfile/tm2_serializer.c of the tmfile Model Loader component. Manipulation of the offset_root argument leads to an out-of-bounds read. The attack can be launched remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6 affecting the function shouldSkipTargetPath in internal/runner/runner.go of the Static Scanner component. Manipulation results in protection mechanism failure. The attack requires local access and the exploit has been publicly released.

In OpenSIPS up to 3.6.8/4.0.1, the rtpproxy_offer/rtpproxy_answer function of the rtpproxy component causes an out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 or 4.0.2 resolves the issue.

A SQL injection vulnerability was found in cemtan sar2html 4.0.0, in the updateDb function of sar2html.py within the Archive Processing component. Manipulation of the s2host argument allows SQL injection. The attack can be launched remotely.

FileRise Pro prior to 3.24.0 returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug via /api/pro/portals/get.php. The response includes the internal storage folder path, client contact email, form settings, and upload-policy details, while the separate publicMeta.php endpoint intentionally exposes only curated branding data.