CVE Vulnerability Catalog

Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker able to obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled.

In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. An authenticated non-administrator with a valid CSRF token and inherited edit permission can create files outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root.

FileRise before 3.23.0 permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account has no TOTP secret. The newly generated secret is persisted and activated before a TOTP code verifies possession, allowing an attacker controlling an existing session to disable or enroll a second factor.

FileRise before 3.23.0 verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker with the target account's valid primary credential who captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes.

FileRise before 3.23.0 in /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A user who owns a source folder can move that tree beneath another user's folder or into the root namespace, and the operation rekeys ownership and ACL records to the new path.

Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit.

A post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in SonicWall Network Security Manager (NSM) on-prem. Under specific conditions, a remote authenticated attacker could execute arbitrary OS commands, resulting in remote code execution.

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. Exploitation requires access to the PAN-OS management interface.

An improper input handling vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.

A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode.

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request. The risk is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses. Cloud NGFW, Panorama, and Prisma Access are not affected.

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.

A type confusion vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.

A command injection vulnerability in the Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.

Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobrancas_geracao.php endpoint accepts POST data via extract($_REQUEST) and inserts it directly into an INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data, or delete database tables.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobranca.php endpoint accepts POST input via extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can execute arbitrary SQL to read or modify WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data.

Prior to 3.8.6, WeGIA's auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute.