CERT Recently Published Vulnerability Notes - TheNote.app

CERT Recently Published Vulnerability Notes
Follow

kb.cert.org/vuls is a webpage maintained by the Carnegie Mellon University Software Engineering Institute (SEI) which provides a publicly accessible database of known software vulnerabilities. It lists a vast amount of vulnerability information including identifiers, descriptions, severity ratings, and potential impacts, helping users stay informed about potential security risks.

CERT Recently Published Vulnerability Notes kb.cert.org

RSS kb.cert.org

RSS Hunter • Aug 19, 2024

Thread Of Notes

VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities

Multiple severe vulnerabilities exist in the FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0, posing risks of remote code execution and full device compromise. Hard-coded, fleet-wide credentials, including AWS IAM keys and Agora token service details, were found embedded in the firmware, accessible without special privileges. Unauthenticated remote command execution via MQTT allowed arbitrary shell commands to be executed as root, leveraging shared IoT credentials. Several local interfaces, such as an HTTP REST API, ADB root shell, and SSH, were exposed without authentication, granting full local compromise and access to sensitive data like Wi-Fi passwords. An insecure STM32 update mechanism fetched firmware over unencrypted HTTP, validated only by MD5, enabling malicious code injection. Sensitive credentials, including the Wi-Fi PSK and /etc/shadow file, were exposed through insecure storage and unauthenticated access. Furthermore, all processes ran as root, lacking privilege separation, meaning any service compromise granted full administrative control. Exploitation could lead to unauthorized access to live camera and microphone feeds, fleet-wide remote root access, Wi-Fi credential extraction, and persistent compromise. The vendor has addressed many issues, removing most hard-coded credentials and arbitrary shell command execution. Local interface vulnerabilities are considered mitigated as they require physical proximity and Wi-Fi connection. Users are strongly advised to update their EarthRover Mini+ firmware to the latest version.

https://kb.cert.org/vuls/id/188754 kb.cert.org

RSS Hunter • Nov 9

VU#385711: PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability

PrestaShop's back-office Performance > Debug mode has a PHP code injection vulnerability. An authenticated attacker can inject malicious PHP code through crafted cookie configuration values. These values are written into an executable PHP configuration file, leading to arbitrary code execution. The vulnerability stems from inadequate escaping of user-controlled debug_cookie_name and debug_cookie_value. Exploitation requires an authenticated back-office account with debug mode modification permissions and a writable configuration file. The injected code executes with the privileges of the PHP process, not requiring root access. This could allow access to secrets, customer data, file modification, and disruption of store operations. Operating-system command execution depends on PHP configuration. PrestaShop version 9.2.1 addresses this issue. Administrators should upgrade to version 9.2.1 or later. If upgrading immediately is not possible, restrict access to Performance and Debug mode settings to trusted administrators. Additionally, limit network access to the back office and prevent the PHP process from writing to config/defines.inc.php and config/defines_custom.inc.php.

https://kb.cert.org/vuls/id/385711 kb.cert.org

RSS Hunter • Nov 9

VU#124705: BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities

Multiple vulnerabilities have been discovered in the Android dating app BaseChat, version 9.8.1. These issues pose a significant risk to user privacy and data security. One vulnerability allows attackers to bypass TLS security checks by accepting self-signed certificates for backend API connections. Another concern is the use of raw MSISDNs, or phone numbers, to map paid accounts to the RevenueCat subscriber database. Because a public API key for RevenueCat is embedded in the app, attackers can query this database using guessed phone numbers. This allows them to retrieve user metadata, including activity and purchase history. The application also logs Personally Identifiable Information (PII) in its production build. Specifically, it records the phone numbers of other callers during voice calls through un-stripped debug statements. These vulnerabilities, if exploited, can lead to account takeover, theft of session credentials, and exposure of private user data. Attackers can also access the PII of other users who are meant to remain anonymous. The app sending other users' phone numbers to the client in any capacity is considered a privacy violation. The developers of BaseChat could not be reached to address these vulnerabilities.

https://kb.cert.org/vuls/id/124705 kb.cert.org

RSS Hunter • Nov 3

VU#203719: INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities

INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 have critical vulnerabilities. These flaws allow attackers to execute arbitrary code on affected systems. One vulnerability, CVE-2026-16305, stems from an improperly protected update manifest. A local attacker can modify a file named execlist.txt due to insecure permissions. This modification allows arbitrary malicious commands to be executed with administrative privileges when an update is approved. The second vulnerability, CVE-2026-16306, is an unsafe command dispatch through the imodular:// URI scheme. A crafted link can trick IModular.exe into executing commands without proper verification. This could lead to code execution with the user's privileges, data access, or further network attacks. Exploitation could allow attackers to install software, access protected files, or disable security. Moreover, it could enable unauthorized outbound communication, potentially exposing sensitive data. INFINITT Healthcare has released fixed versions, 3.0.12.3 and 3.0.12.5, to address these issues. Users are advised to upgrade to these patched versions as soon as possible.

https://kb.cert.org/vuls/id/203719 kb.cert.org

RSS Hunter • Nov 2

VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation

A vulnerability exists in Fireblocks' mpc-lib library's BIP32 hardened derivation implementation. This flaw allows an attacker to recover higher-level private key shares from a compromised lower-level share. The issue arises when a parent private key is missing, leading the system to substitute a null buffer, effectively becoming a known constant of zero. This violation of ancestor isolation means a compromised descendant share can be used to derive its parent share. The vulnerability can then be repeated up the entire key hierarchy. While this does not immediately allow for theft of funds, it significantly weakens security defenses. The hardened derivation is no longer a reliable isolation layer for signer shares. The compromise can propagate silently, leaving no error signals. Integrators are advised to treat chain codes as secret, as the derivation delta calculation depends on them. Keeping chain codes confidential prevents public computability of the delta. Alternatively, do not solely rely on hardened derivation for isolation between signer shares. Auditing derivation paths and acknowledging potential cross-hierarchy compromise is also recommended. A complete solution requires a library code change, for which no vendor fix is currently available.

https://kb.cert.org/vuls/id/701544 kb.cert.org

RSS Hunter • Oct 26

VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling

Vsomeip, an automotive communication middleware, had a critical memory allocation vulnerability in versions 3.7.3 and below. This flaw allowed remote attackers to exhaust host memory and cause denial of service. The vulnerability affected reliable TCP endpoints, where the software would grow its receive buffer based on an attacker-declared message size before confirming reception. Without any configured size limits, an attacker could request up to 4 GB of memory per connection. This could lead to a service termination even on memory-constrained systems. The issue was publicly disclosed as COVESA/vsomeip issue #1009. The problem was fixed in vsomeip release 3.7.4, which introduced a default maximum message size of 10 MiB. Deployments unable to upgrade can mitigate by explicitly configuring message size limits. Network segmentation to isolate reliable endpoints from untrusted networks is also recommended. Monitoring for unusual memory growth and connection attempts can help detect exploitation.

https://kb.cert.org/vuls/id/128947 kb.cert.org

RSS Hunter • Oct 26

VU#763488: Memory corruption vulnerabilities in PHP

Two memory-related vulnerabilities have been discovered in PHP versions prior to specific patched releases. An unauthenticated remote attacker can exploit these flaws by sending crafted HTTP requests. The first, CVE-2026-109618, is a memory corruption issue in PHP's out-of-memory handling. This occurs when an out-of-memory condition interrupts request processing with partially initialized data. Subsequent cleanup attempts access invalid memory, leading to corruption and potential code execution. The second, CVE-2026-109619, is a use-after-free vulnerability in global state management. This happens when a worker retains a reference to freed request memory, allowing a subsequent request to access stale state. Both vulnerabilities can result in arbitrary code execution, compromising confidentiality, integrity, and availability. Apache mod_php deployments are particularly at risk, as exploitation can occur before application code runs. The solution is to update PHP to the patched versions immediately. If patching is not possible, temporary mitigations for both CVEs are available. These include adjusting memory limits, disabling session upload progress, and enforcing server-level request limits. Network segmentation and running PHP with minimal privileges can also limit impact.

https://kb.cert.org/vuls/id/763488 kb.cert.org

RSS Hunter • Oct 22

VU#645818: Xerj Console API Authentication Bypass Leads to Unauthorized Credential Minting

An authentication bypass vulnerability exists in the Xerj Console API. This flaw allows existing valid tokens to create independent successor credentials. It bypasses mandatory passkey requirements during token issuance. The Xerj system converts different session types into a generic authentication object. The token creation handler does not verify if the session was passkey-backed. An attacker can exploit this by obtaining a valid API token. They can then directly invoke the token creation endpoint. This enables the creation of new credentials with the same access levels. Xerj lacks hierarchical revocation, so parent token revocation does not affect descendant tokens. This grants attackers persistent, unauthorized access, bypassing multi-factor controls. If an account owner's token is compromised, the successor token retains administrative authority. An attacker can use this to create and control an independent passkey for permanent instance control. No official patch is available as the vendor could not be reached. Users should monitor the GitHub repository for updates and install a fix when released.

https://kb.cert.org/vuls/id/645818 kb.cert.org

RSS Hunter • Oct 20

VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic

BoringSSL has identified five issues related to how certificate name constraints are applied to Subject Alternative Names. These findings concern the legacy crypto/x509 path and the newer pki path within BoringSSL. Two of the vulnerabilities, VU#410595.8 and .12, concerning wildcard DNS names and trailing-dot DNS names respectively, have been fixed. VU#410595.9, related to URI constraints and colons before '@', has been accepted and is under coordination. VU#410595.10, regarding first-@ domain extraction in rfc822Name matching, remains disputed due to unclear exploitation potential. VU#410595.11, concerning trailing-dot handling in rfc822Name domains, was declined by the BoringSSL team as it was deemed below their security threshold. The impact of these issues is limited to scenarios where name constraints are enforced, trusted signatures are obtainable over attacker-controlled SAN fields, and the accepted name is used for authorization. The presence of BoringSSL in a product does not automatically imply that the product is affected, as specific paths and name forms must be invoked. Fixes for the vulnerabilities are applied through BoringSSL's upstream repository and subsequently integrated into products via their update mechanisms. Operators are advised to verify if their deployments use affected paths, apply available updates, and ensure that issued SANs are well-formed to mitigate potential risks.

https://kb.cert.org/vuls/id/410595 kb.cert.org

RSS Hunter • Oct 14

VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement

This document details thirteen library-specific records concerning the implementation of X.509 Name Constraints. These records highlight inconsistencies in how various TLS libraries handle these constraints, leading to situations where a name accepted by one library might be rejected by another. Some of these issues have been resolved, while others are still under review or were not deemed security vulnerabilities. Name Constraints are designed to confine Certificate Authorities (CAs) within a defined namespace. Discrepancies exist in handling DNS name case sensitivity and wildcard matching, with libraries like GnuTLS and Go exhibiting varied behaviors. pyca/cryptography was found to validate constraints against SANs but not against the requested peer name. Libraries also differ in how they treat IPv4 and IPv6-mapped IPv6 forms for IP address constraints. URI handling presents further inconsistencies, particularly regarding host extraction from URI SANs. AWS-LC and s2n-tls have reported issues with wildcard Common Name fallback when leaf certificates lack SANs. Mbed TLS, in a specific configuration, does not enforce non-critical Name Constraints, contrary to RFC 5280 requirements. The impact of these inconsistencies is relevant only when an attacker can forge a trusted signature and exploit a validation path for authorization. CERT/CC is coordinating remediation efforts with affected projects, with varying statuses reported for each library. Operators relying on Name Constraints are advised to verify their libraries' behavior and prioritize explicit SANs and issuance policies.

https://kb.cert.org/vuls/id/948176 kb.cert.org

RSS Hunter • Oct 14

VU#166125: Bisheng has authentication bypass vulnerabilities

Bisheng, an open-source LLM DevOps platform, suffers from three critical vulnerabilities. A pre-authentication account takeover is possible through a legacy Single Sign-On (SSO) endpoint. This flaw allows attackers to create accounts with administrative privileges by bypassing proper authentication mechanisms. An Insecure Direct Object Reference (IDOR) vulnerability exposes cross-user workflow data, enabling any authenticated user to access sensitive configurations of others. Additionally, prior to version 2.5.0, authenticated users could abuse LLM credentials and disclose data due to missing access checks. These issues collectively allow unauthenticated attackers to gain administrative control. Authenticated users can exploit these flaws to access sensitive information and hardcoded credentials. The IDOR and credential abuse vulnerabilities have been patched in versions 3.0.0 and 2.5.0 respectively. However, the legacy SSO bypass vulnerability remains unpatched. Mitigation strategies for the SSO flaw include avoiding specific environment configurations and disabling or securing the legacy SSO endpoint. Restricting network access to this endpoint is also recommended.

https://kb.cert.org/vuls/id/166125 kb.cert.org

RSS Hunter • Oct 14

VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability

Periphery, an agent for the Komodo server management platform, has a critical vulnerability in versions up to 2.2.0. This vulnerability lies in the improper validation of container names, allowing OS command injection. Attackers can exploit this through container destruction or container log searches. By providing a specially crafted container name, an authenticated attacker can execute arbitrary commands as the root user. This compromise grants persistent control over the underlying host system. Komodo is an open-source server and deployment manager used in self-hosted and Docker multi-server setups. Periphery is the agent that allows Komodo to manage Docker environments on these servers. The vulnerability arises because container names are directly inserted into shell commands without proper escaping or validation. These commands, executed with Periphery's root privileges, provide a direct pathway for exploitation. The impact is significant, enabling attackers to gain root access, establish persistence, and compromise the entire managed infrastructure. Fortunately, Komodo has released a patch for this issue, with versions 2.3.0 and above being secure. Users are strongly advised to update their Komodo installations immediately to mitigate this risk.

https://kb.cert.org/vuls/id/456950 kb.cert.org

RSS Hunter • Oct 13

VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Lowcoder version 2.4.10 has an authorization bypass vulnerability in its Query Library feature's API. This flaw allows authenticated users with admin or dev roles to access private query data from other organizations in a multi-tenant instance. The vulnerable API endpoints for metadata retrieval and query execution fail to check if the requested resource belongs to the user's organization. While role-based access is present, it only validates the role against the user's own organization.An attacker with admin or dev privileges in any organization can view the full DSL of other organizations' library queries. They can also execute any library query on the instance, receiving data directly from the affected organization's backend. This can lead to cross-tenant data exposure, modification, or destruction. Additionally, attackers could cause cost abuse by querying paid data sources using another tenant's resources. The vulnerability violates data isolation between organizations.Unfortunately, Lowcoder has not been reachable to coordinate a fix for this issue. Administrators are advised to restrict access to the affected API endpoints and limit application access to trusted users. Reviewing admin and dev role assignments is also recommended. For multi-tenant deployments, isolating tenants into separate instances offers broader protection. If source-code modification is possible, implementing organization-level authorization checks for these API calls is crucial.

https://kb.cert.org/vuls/id/382143 kb.cert.org

RSS Hunter • Oct 13

VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation

TLS libraries exhibit varying interpretations of X.509 Name Constraints, leading to certificate acceptance or rejection inconsistencies. These differences arise from implementation defects and areas not fully specified by RFC 5280. Specifically, disparities exist in how DNS name comparison handles case sensitivity. IP address handling also differs, particularly regarding IPv4-mapped IPv6 addresses. URI-authority parsing presents inconsistencies in extracting the host when specific characters or components are present. Wildcard matching semantics for Subject Alternative Names are not clearly defined, causing further divergence. Some issues are outright implementation defects, while others stem from the RFC's lack of explicit guidance. The impact of these differences is limited, requiring a combination of a compromised trusted signature, a vulnerable validation path, and an application using the identity for authorization. Mixed environments like service meshes or CDNs may encounter inconsistent certificate validation for the same certificate. CERT/CC is collaborating with affected TLS library projects to address these issues. Operators requiring high assurance should test their validators, apply updates, and use explicit Subject Alternative Names. Application-layer allow-lists and issuance policies can also help mitigate these differences.

https://kb.cert.org/vuls/id/573195 kb.cert.org

RSS Hunter • Oct 13

VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Shopware 6.7 has a stored cross-site scripting (XSS) vulnerability in its media upload feature. This flaw allows attackers to compromise administrator credentials and achieve remote code execution. The vulnerability stems from the media upload API accepting HTML files which are then served as text/html without proper security headers. An attacker with media upload privileges can upload a malicious HTML file containing JavaScript. If an administrator accesses the media file, their authentication token can be stolen. This stolen token allows the attacker unauthorized access to the Shopware Administration API. If the compromised administrator has extension management rights, the attacker can install malicious plugins. This can lead to arbitrary PHP code execution on the server. No patch is currently available from Shopware. Users can mitigate the risk by restricting media upload access or disabling HTML file uploads.

https://kb.cert.org/vuls/id/157374 kb.cert.org

RSS Hunter • Oct 13

VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Versions 2.6.0 and 2.6.1 of Thelia, an e-commerce platform, contain numerous security flaws. These vulnerabilities span file management, templating, module installation, and administrative functions. Exploits can lead to remote code execution, server-side template injection, and cross-site scripting. Some issues allow administrative users to upload malicious files, enabling code execution on the server. The store banner upload feature also has insufficient validation, allowing PHP files disguised as images to be uploaded. An open redirect vulnerability exists in the address creation workflow, allowing attackers to redirect users to malicious sites. Stored XSS vulnerabilities in the administrative interface permit JavaScript execution when affected pages are viewed. Username enumeration is possible due to differing error responses for invalid credentials. Reflected XSS can occur in Smarty templates by failing to escape double quotes. Email templates lack proper restriction of dangerous PHP functions, enabling arbitrary command execution. Module installation without validation allows the inclusion of malicious PHP code. Version 2.6.1 has path traversal and PHP code injection vulnerabilities in its translation editor, leading to remote code execution. An absolute path traversal in Smarty template handling enables server-side template injection and RCE. No patch is currently available, so users should restrict administrative access and disable file upload features.

https://kb.cert.org/vuls/id/162329 kb.cert.org

RSS Hunter • Oct 12

VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations

A critical Out-of-bounds Write vulnerability exists in InsydeH2O IHISI software used by HP PC BIOS. This flaw allows a local attacker with OS kernel privileges to write to arbitrary physical memory. The vulnerability is exploitable because the vulnerable code runs in the highly privileged System Management Mode (SMM). Successful exploitation could enable an attacker to modify SMM-protected memory. This modification might lead to arbitrary code execution within SMM. The vulnerability enables reading or writing arbitrary physical memory, including System Management RAM (SMRAM). An attacker can trigger this vulnerability by issuing a Software SMI via I/O port 0xB2 with crafted CPU register values. The affected handler fails to validate parameters, allowing manipulation of memory addresses and data. Consequently, an attacker could achieve persistence by modifying SMRAM and potentially altering SMM execution. Users should consult HP's security bulletins to identify if their system is affected.

https://kb.cert.org/vuls/id/553437 kb.cert.org

RSS Hunter • Oct 1

VU#762428: Authlib library contains a signature‑verification bypass vulnerability

Authlib versions up to and including 1.7.2 have a critical signature-verification bypass vulnerability in JWS general JSON serialization. The deserialize_json function incorrectly accepts JWS objects with an empty signatures array. This allows attackers to bypass signature verification entirely. Consequently, unsigned data is treated as if it were legitimately signed by the library. Attackers can exploit this by providing forged content without needing any key material. This flaw impacts both direct JSON deserialization and string deserialization methods. The primary impact is the ability for attackers to forge arbitrary authenticated payloads. This can lead to authentication bypass and privilege escalation by injecting forged identity claims. Microservices relying on JWS for message integrity are also vulnerable to injection attacks. Systems using JWS for authorization can be tricked into accepting forged scopes or roles. At present, no official patch is available as the vendor could not be reached. Users should monitor Authlib's GitHub repository for a fix and update accordingly.

https://kb.cert.org/vuls/id/762428 kb.cert.org

RSS Hunter • Sep 28

VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities

Three cross-site scripting vulnerabilities have been identified in Readwise Reader for Android version 8.7.2. Attackers can exploit these flaws by creating malicious documents or metadata. Successful exploitation allows arbitrary JavaScript execution within the application's WebView. This could lead to the compromise of user data, including documents, credentials, and session tokens. CVE-2026-18311 affects header rendering due to insufficient HTML escaping of metadata fields like author and title. CVE-2026-18312 impacts WebView URL construction for X videos and iOS paywall messages due to improper URL metadata escaping. CVE-2026-18320 stems from a wildcard attribute rule in the article body sanitization allowing malicious SVG markup. These vulnerabilities enable stored XSS when documents are synchronized to Android devices. While the vendor has not been reachable, version 8.10.1 reportedly patches the sanitizer-wildcard issue. Users are advised to update the app and exercise caution with untrusted content.

https://kb.cert.org/vuls/id/699627 kb.cert.org

RSS Hunter • Sep 25

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

ViewSonic's vCast software, a component of ViewBoard smartboards, suffers from multiple critical vulnerabilities. These weaknesses can be exploited in sequence by an attacker to gain complete control of the device. The smartboards are commonly found in businesses and schools. vCast facilitates wireless connections between these Android-based devices and client applications. Three specific vulnerabilities affect unauthenticated endpoints within the vCast suite.One vulnerability allows remote attackers to steal JPEG screenshots of the screen content via specific API requests. Another flaw enables the triggering of unprivileged file installations by supplying a malicious APK URL to an exposed download endpoint. A third vulnerability permits remote attackers to inject arbitrary input into service endpoints through HTTP requests. By chaining these vulnerabilities, an unauthenticated attacker can execute arbitrary code on a vCast device without user interaction. This can lead to unauthorized access to displayed content and persistent installation of malicious applications. Exploited devices could also serve as a gateway for lateral movement on a connected network. ViewSonic has not yet been reached for comment or to coordinate a fix. Users are advised to apply firmware updates when available and isolate vCast devices on secure, separate networks. Monitoring network traffic for suspicious vCast connections is also recommended.

https://kb.cert.org/vuls/id/234131 kb.cert.org

RSS Hunter • Sep 24

VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability

Norwegian Cruise Line ships have door access controllers with an improper authentication vulnerability. These controllers are susceptible to replayed unique identifiers from RFID devices, allowing unauthorized entry. The affected card readers authenticate NFC credentials solely by verifying their static 7-byte UID. This UID is not secret and lacks cryptographic challenge-response capabilities, making it an unreliable authentication factor. Although keycards have memory blocks with serial numbers and signature-like values, the reader ignores this data. Relying only on the UID means the system is identifying rather than authenticating. Since there's no cryptographic exchange, any device capable of replaying or emulating UIDs can create a working duplicate. An attacker can capture a valid keycard's UID with brief physical proximity and an RFID reader. This UID can then be copied to a writable card, creating a counterfeit credential. These fakes will be accepted as genuine by the access control readers, granting unauthorized access. In some cases, these unauthorized entries may not be distinguishable from legitimate use. This poses a significant security risk to both ship operations and guest safety, especially concerning access to restricted areas. Currently, there is no vendor-provided solution, but users can employ RFID-blocking wallets or shielded sleeves to mitigate cloning risks. Wrapping cards in aluminum foil can also create a basic Faraday shield to limit signal transmission. Keeping cards at least 12 inches away from others can help prevent unwanted scans.

https://kb.cert.org/vuls/id/676317 kb.cert.org

RSS Hunter • Sep 24

VU#273940: Enterprise Access Management EAM does not rotate RSA keys

Imprivata Enterprise Access Management (EAM) versions 26.2.6 and below have a vulnerability. The platform uses an RSA key pair to generate its X.509 certificate for authentication. Crucially, there is no supported method to rotate this key pair after initial deployment. This means the same key is used indefinitely for certificate generation. Using a single, unchangeable key pair indefinitely is a significant departure from cryptographic best practices. If an attacker obtains the private key, they can indefinitely impersonate the EAM appliance. This impersonation allows the attacker to intercept authentication traffic, including credentials and SSO tokens for critical systems like EHRs. Previously captured encrypted traffic could also be decrypted retroactively if perfect forward secrecy is not enforced. Imprivata is aware of the issue and is reportedly working on a resolution. However, no fix or timeline has been released yet. In the interim, users should heavily restrict access to the appliance's private key, backups, and snapshots. Enforcing perfect forward secrecy on connections can also mitigate some of the impact.

https://kb.cert.org/vuls/id/273940 kb.cert.org

RSS Hunter • Sep 23

VU#754548: Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

Cinnamon's Kotaemon, a RAG-based chatbot tool, suffers from a critical security flaw allowing unauthorized access to user conversations. Versions up to v0.12.0 fail to verify conversation ownership before loading or modifying them. Any authenticated user can exploit this by simply knowing another user's conversation ID. This allows them to read, delete, rename, or overwrite any conversation.The vulnerability affects four handlers: select_conv, delete_conv, rename_conv, and persist_chat_suggestions. Without proper authorization checks, these handlers operate on conversations irrespective of ownership. The select_conv handler can expose full chat transcripts and sensitive retrieval history containing excerpts from private documents. Delete_conv allows for permanent deletion of any conversation, with no recovery option.Rename_conv permits renaming conversations, while persist_chat_suggestions can be used to inject malicious prompt suggestions. The disclosure of retrieval history is particularly concerning for enterprise use cases involving proprietary data. Attackers can gain access to sensitive document content without needing direct file-read permissions. Since public conversations display their UUIDs, even private conversations are at risk. No elevated privileges are needed to exploit this vulnerability, only an authenticated account. A solution is not yet available as the vendor could not be reached.

https://kb.cert.org/vuls/id/754548 kb.cert.org

RSS Hunter • Sep 23

VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass

Vendor-signed UEFI Shell applications can be exploited to bypass Secure Boot protections. The vulnerability lies in built-in memory modification commands within certain UEFI Shell implementations. If a system trusts the vendor's certificate or the application's hash, an attacker can use these commands to disable Secure Boot. This allows for the execution of untrusted UEFI code before the operating system loads. Such an attack would bypass standard security measures and EDR solutions. Researchers identified multiple affected UEFI Shell applications from various vendors. To mitigate this, system administrators must apply firmware and software updates from hardware vendors. These updates will replace the vulnerable applications with secure versions. Additionally, updating and verifying the UEFI DBX can revoke trust in the compromised binaries. This prevents them from executing during the boot process.

https://kb.cert.org/vuls/id/738147 kb.cert.org

RSS Hunter • Sep 22

VU#280377: Dokploy is vulnerable to OS command injection

Dokploy versions 0.29.8 and 0.29.11, along with a specific canary branch commit, contain a critical OS command injection vulnerability. This exploit occurs during backup creation and restoration processes due to improper sanitization of user input. The Dokploy application, which runs with root privileges by default, constructs shell commands using this unsanitized input. This allows authenticated users with backup permissions to inject malicious commands. These commands are then executed by the system's shell, granting attackers root-level access to the Dokploy host. Exploitation can lead to full compromise of the target device, including filesystem access and theft of credentials. The vulnerability affects all five database types supported by Dokploy. While Dokploy developers were unreachable, the issue has been fixed in versions 0.29.13 and later. Users are strongly advised to update to the patched versions immediately. As a mitigation, disabling default backup permissions and restricting them to only essential users is recommended for those unable to update. This vulnerability was reported by Muhammadjon Ahmadjonov.

https://kb.cert.org/vuls/id/280377 kb.cert.org

RSS Hunter • Sep 17

VU#369093: MLflow dspy and statsmodels flavors bypass pickle deserialization control

MLflow, a platform for managing machine learning lifecycles, has a vulnerability in its dspy and statsmodels model flavors. This issue allows unauthorized execution of pickle deserialization, bypassing a safety control. The dspy flavor has a conditional safety control that can be circumvented if the model path does not end with .pkl. The statsmodels flavor completely lacks this safety control, making it vulnerable by default. Loading models via these flavors requires specifying a model and path in an MLmodel file. Exploiting this vulnerability enables arbitrary remote code execution. An attacker could achieve this by loading a malicious pickle payload through a vulnerable flavor. The attack requires write access to the location from which MLflow models are obtained. This vulnerability was confirmed in MLflow version 3.12.0. MLflow has patched the statsmodels flavor in versions 3.15.0 and later. Users are advised to upgrade their MLflow installations. Until the dspy flavor vulnerability is fixed, users should avoid loading models through it if they want to prevent pickle deserialization.

https://kb.cert.org/vuls/id/369093 kb.cert.org

RSS Hunter • Sep 16

VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

A vulnerability exists in Sentry Seer, tracked as CVE-2026-90999, when automated issue remediation is enabled. Sentry is a platform for monitoring software errors and performance. Seer is an automated debugging assistant within Sentry that can generate remediation steps and hand off issues to a coding agent. Attackers can craft malicious events and submit them to Sentry via a public DSN. These events can bypass trust boundaries when Seer is configured to automatically pass issues to a coding agent. Malicious fields within these events are processed by Seer and can be transformed into untrusted instructions for the coding agent. The vulnerable workflow involves Sentry ingesting attacker-generated events that Seer analyzes. Seer uses attacker-controlled fields to generate a root-cause analysis that is embedded in the prompt for the coding agent. The coding agent then interprets this fabricated analysis and may download and execute attacker-controlled packages. This can lead to arbitrary code execution within the coding agent's environment and access to connected source repositories. No patch is currently available, but mitigations include disabling automated remediation or the Seer handoff feature. Restricting coding agent package installation is also a potential mitigation.

https://kb.cert.org/vuls/id/212479 kb.cert.org

RSS Hunter • Sep 16

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

A security vulnerability has been discovered in the exllamav3_ext CUDA extension, identified as CVE-2026-84286. The issue stems from an out-of-bounds memory access caused by unchecked array indexing. Specifically, when the kernel parameter K is set to 0, the code generates a negative array index. This occurs because the checkpoint-derived block index is used to access a fixed-size array without proper validation. The lack of a bounds check during the kernel-table dispatch process is the root cause. Exploiting this vulnerability can lead to an immediate denial of service or application instability. The vendor has released a fix in their main repository. Users should update their installations or apply the patch from the provided pull request. Downstream projects that depend on this library are also indirectly affected. Developers of these dependent repositories are urged to rebuild their packages against the patched version. This vulnerability was discovered by Nathan Keys and reported responsibly.

https://kb.cert.org/vuls/id/369611 kb.cert.org

RSS Hunter • Sep 11

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

An incorrect permissions assignment vulnerability exists in the amwrtdrv.sys kernel driver of AOMEI Backupper 8.4.0. This flaw allows an unprivileged local user to write arbitrarily to the physical disk. When Secure Boot is disabled, this can be exploited to execute malicious UEFI-level code before the operating system loads. Such an attack bypasses OS security controls like HVCI, EDR, and Windows Defender. Additionally, it may allow capture of BitLocker Volume Master Key material. The driver creates a world-accessible device object, enabling unrestricted write requests from any user-mode process. Attackers can modify disk sectors to inject a malicious UEFI payload. This payload executes during the UEFI Boot Device Selection phase, before OS security is active. A successful exploit allows UEFI code injection, bypassing all kernel-mode security. On systems with TPM-only BitLocker, this enables pre-boot VMK credential capture. AOMEI has released patches to address this vulnerability. Users should update to a corrected version or uninstall the software. Disabling the amwrtdrv.sys service is a temporary mitigation. Enabling Secure Boot offers defense in depth but does not fix the root cause.

https://kb.cert.org/vuls/id/687587 kb.cert.org

RSS Hunter • Sep 10

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

The UEFI Shell, when present in firmware, can be exploited to bypass Secure Boot protections. This program offers raw memory access capabilities, which could be abused by attackers. If an attacker can modify UEFI boot configuration, they might create new boot entries to launch the UEFI Shell. This bypasses intended controls that prevent its execution with Secure Boot enabled. The shell's powerful commands like dmem and mm allow direct physical memory access. Attackers could then modify the pre-boot environment, including Secure Boot memory values. This enables the execution of unauthorized software during system startup. The impact is significant, allowing for persistent access and undermining OS security. Applying firmware patches is the primary solution to address this vulnerability. Enterprises should also review Secure Boot configurations and monitor for unauthorized boot entry modifications.

https://kb.cert.org/vuls/id/718077 kb.cert.org

RSS Hunter • Sep 8

VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Skullcandy Dime 3 wireless earbuds, firmware version 1.0.0.28, have a vulnerability allowing unauthorized Bluetooth Classic pairing. These earbuds accept pairing requests from unpaired devices without any user interaction or confirmation. The vulnerability stems from the Airoha chipset used in the earbuds.An attacker within Bluetooth range can pair with the earbuds without prior connection or physical access. They can send a direct pairing request without a PIN or passkey. The earbuds' NoInputNoOutput capability allows this immediate bonding.Once paired, the attacker's device becomes trusted and can automatically reconnect. This enables audio hijacking, interrupting the legitimate user's connection. The only notification for the user is an audible alert after the unauthorized pairing has occurred.Beyond audio, an attacker could potentially access other services on the earbuds. They can also utilize the Hands-Free/Headset profile to capture live microphone audio. The vendor has released a patch in firmware version 1.0.0.30.However, Skullcandy Dime 3 earbuds do not support firmware updates via their application. This means existing units with the vulnerable firmware cannot be updated by customers. There are currently no known methods for users to update their existing devices to the patched firmware.

https://kb.cert.org/vuls/id/859658 kb.cert.org

RSS Hunter • Sep 8

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery vulnerability exists in the ONLYOFFICE ownCloud integration plugin version 9.12. This flaw allows authenticated administrators to manipulate the plugin's backend endpoint. The endpoint fails to properly validate the user-supplied document server URL before initiating outbound connections. An attacker can exploit this by providing arbitrary URLs, including internal network hosts or localhost addresses. This is achieved by sending crafted configuration requests to a specific endpoint. The ownCloud server is then coerced into issuing arbitrary network requests to attacker-controlled destinations. This enables the attacker to use the ownCloud server as a proxy for malicious activities. Furthermore, differences in error messages allow for internal network reconnaissance and port enumeration. The vulnerability grants access to localhost services not reachable externally. While no official patch is available, disabling or removing the plugin is recommended as a mitigation. Implementing network-level egress controls to limit outbound connections is also advised.

https://kb.cert.org/vuls/id/943094 kb.cert.org

RSS Hunter • Sep 8

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor, an open-source access management platform, has an authorization bypass vulnerability. This flaw affects versions 3.115.0 and earlier. It allows non-global organization administrators to execute unauthorized administrative actions on other organizations. The vulnerability arises from a desynchronization between Casdoor's authorization checks and its action execution. Specifically, the authorization layer uses a URL parameter for decisions, while controllers rely on request body fields. This discrepancy means authorization is checked against one object, but an operation is performed on another. In multi-tenant setups, an administrator within one organization can bypass tenant isolation. Exploitation can lead to unauthorized user management, privilege manipulation, and disruption of SSO or SAML identities. This can escalate to a full compromise of tenant isolation or even the entire Casdoor instance. Unfortunately, no vendor patch is currently available. Mitigation strategies include enforcing least privilege, requiring MFA for administrators, and alerting on cross-organization administrative activity.

https://kb.cert.org/vuls/id/889462 kb.cert.org

RSS Hunter • Sep 3

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.49.0 through 5.8.1 allows unauthorized writing of attacker-controlled Python files. The library fetches and caches remote modules before verifying user consent for remote code execution. This means a malicious Python file from a model repository will be written to the user's local cache regardless of trust prompt approval. The vulnerability stems from an unconditional file copy operation that occurs before the trust_remote_code check. This process differs from other remote code loading mechanisms within the library. An attacker could create a model with a malicious custom_generate/generate.py file. Any user loading this model reference triggers the unauthorized file write. The cached malicious files persist even if the trust prompt is declined. In shared cache environments, these files could be executed later during trusted model loads. There is currently no vendor-provided patch. Users should avoid using load_custom_generate() with untrusted repositories and periodically clear their Hugging Face module cache.

https://kb.cert.org/vuls/id/456290 kb.cert.org

RSS Hunter • Sep 1

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

The Kaltura HTML5 Player Library, specifically versions html5lib v2.45, v2.103 and earlier, contains two critical vulnerabilities. Both stem from an insecure deserialization flaw within the mwEmbedLoader.php endpoint. This endpoint allows user-controlled ServiceUrl parameters for backend API requests. The internal KalturaClientBase PHP library fetches data from this URL and deserializes it without validation.CVE-2026-19913 allows arbitrary file reads by exploiting the deserialization flaw and improper error handling. An attacker can provide a file:// path to ServiceUrl, causing the player to fetch and attempt to deserialize local file contents. Failed deserialization reflects raw bytes in error messages, revealing sensitive file data.CVE-2026-19912 enables remote code execution due to insufficient sanitization of the uiconf_id parameter. This parameter controls file write locations, allowing directory traversal attacks. An attacker can craft a malicious serialized object with executable PHP code and redirect its deserialized fields to a web-accessible directory.Exploiting these vulnerabilities requires only network access to the affected endpoint; no authentication is needed. Successful attacks can lead to the theft of sensitive information like credentials or API keys. Remote code execution allows for data manipulation, persistence, and further system compromise. These vulnerabilities also affect tenants on Kaltura's shared CDN infrastructure.Until a vendor patch is released, users should restrict or disable external access to mwEmbedLoader.php. Implementing a strict allow-list for ServiceUrl to permit only legitimate API URLs is also recommended.

https://kb.cert.org/vuls/id/308749 kb.cert.org

RSS Hunter • Aug 25

VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow

Metal Gear Online 3, a competitive shooter, has a critical security flaw. This vulnerability stems from an input validation issue within the game's Steam lobby metadata processing. Specifically, the game fails to check the size of a buffer used to store Steam IDs of removed players. When a lobby host crafts specific data, they can trick clients into writing beyond this buffer's boundaries. This out-of-bounds write corrupts adjacent memory structures responsible for handling game events.By carefully manipulating this overflow, attackers can hijack the control flow of the game on client machines. This allows them to execute arbitrary code. The exploit is triggered automatically when a player joins an attacker-controlled lobby. The vulnerability is particularly severe because the game binary contains regions with read-write-execute permissions, enabling code injection. An attacker can gain host privileges and then distribute malicious data to all connected players. Konami has addressed this vulnerability in version 1.1.2.9 of Metal Gear Online 3. This patch also updated server and lobby versions to prevent older clients from connecting.

https://kb.cert.org/vuls/id/728712 kb.cert.org

RSS Hunter • Aug 24

VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

The Calix GS7 XGS GS5239XG router, running firmware EXOS/6.6.47, has a critical security flaw. This vulnerability affects its UPnP service, specifically the WANIPConnection aspect. The UPnP service is exposed on the router's public WAN interface without any authentication required. This means a remote attacker can interact with the UPnP service without needing credentials. They can gain full control over the router's essential UPnP functions. This includes the ability to add, delete, and view NAT port mappings. By manipulating these mappings, an attacker can bypass NAT and firewall protections. This action exposes devices on the internal network to the public internet. Residential users are at high risk due to the default UPnP enabled configuration. A vendor patch is not yet available, but users can disable UPnP if possible. If disabling is not an option, contacting the ISP for deactivation might be necessary. Another mitigation involves filtering inbound traffic to TCP port 5000.

https://kb.cert.org/vuls/id/756733 kb.cert.org

RSS Hunter • Aug 21

VU#874418: RDK-B WebUI contains multiple vulnerabilities

The RDK-B WebUI version rdkb-2025q4-kirkstone harbors multiple critical vulnerabilities. These weaknesses include problems with memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker connected to the network could potentially bypass authentication and gain administrative control. These vulnerabilities can also lead to denial-of-service conditions by corrupting memory in underlying RDK-B processes. In some scenarios, this memory corruption might even allow for arbitrary code execution. One specific flaw involves JWT authentication that fails to properly verify cryptographic signatures. Another race condition in the login process can allow an attacker to inherit another user's authentication result. A vulnerability in the login handler allows for denial-of-service by submitting excessively large password values. A data parser flaw can lead to memory corruption and potential code execution due to malformed input. Finally, an authenticated administrator can cause denial-of-service and potential code execution by triggering memory corruption in the rtrouted process. Due to the lack of a coordinated update from RDK Central, users are advised to restrict WebUI access to trusted networks and authorized hosts.

https://kb.cert.org/vuls/id/874418 kb.cert.org

RSS Hunter • Aug 19

VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Two vulnerabilities, CVE-2026-6726 and CVE-2026-6727, have been discovered in the TPM 2.0 reference implementation. CVE-2026-6727 is a timing side-channel flaw in RSA OAEP decryption. CVE-2026-6726 is an information leakage vulnerability related to falsified TPM keys. These issues require privileged local access to the TPM command interface to be exploited. Successful exploitation could allow an attacker to decrypt data encrypted to TPM-managed RSA keys. It may also enable the creation of fraudulent TPM 2.0 attestations using forged keys. The vulnerabilities are detailed in TCG advisories TCGVRT010 and TCGVRT0011. TPM vendors have addressed these flaws by releasing updated firmware and software. Users should apply these updates from their platform or TPM vendor. Cloud providers using software TPMs may have also deployed necessary patches. The overall impact varies based on TPM implementation and usage.

https://kb.cert.org/vuls/id/431093 kb.cert.org

RSS Hunter • Aug 11

VU#614868: Opencart ecommerce platform contains directory traversal vulnerability

OpenCart version 4.2.0.0 has a directory traversal vulnerability in its extension installer. This flaw allows attackers to place files anywhere on the server by exploiting how zip files are extracted. The installer extracts uploaded .zip files without validating the paths derived from the zip entry filenames. Attackers can craft malicious extensions using sequences like ../ to navigate outside the intended directory. This could enable them to write files, including a PHP web shell, into the webroot. If an administrator installs such an extension, it can lead to remote code execution with OpenCart's server privileges. The creation of a web shell further allows for system-level command execution. The vulnerability has been confirmed in version 4.2.0.0, and other 4.x versions might also be vulnerable. A patch is currently unavailable as OpenCart could not be reached for coordination. Users are advised to update to the latest version and avoid installing extensions from untrusted sources while configuring OpenCart with minimal necessary privileges.

https://kb.cert.org/vuls/id/614868 kb.cert.org

RSS Hunter • Aug 10

VU#987105: The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

A heap buffer overflow vulnerability has been identified in the stb TrueType library, specifically in versions 1.26 and earlier. This vulnerability arises from improper handling of malformed TrueType Font (TTF) data within the stbtt_GetGlyphShape() function. The issue occurs during the parsing of glyph contours, where the function iterates based on contour endpoint information. However, it fails to validate that the pointer for these points stays within the allocated glyph data buffer's boundaries. An attacker can exploit this by creating a malicious TTF file with an oversized endpoint count and insufficient glyph data. When an application processes this malformed font using stbtt_GetGlyphShape(), it can lead to out-of-bounds reading of heap memory. The primary impact of this vulnerability is Denial of Service (DoS) due to application crashes from invalid memory access. Additionally, attackers might be able to disclose sensitive information by reading adjacent heap memory. Unfortunately, the stb maintainers have not yet been reachable to coordinate a fix, so users should monitor the project's GitHub for updates. As a precautionary measure, users are advised to consider the warning on the project's README regarding potential delays in security fixes.

https://kb.cert.org/vuls/id/987105 kb.cert.org

RSS Hunter • Aug 7

VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

A cross-site scripting vulnerability has been discovered in Alinto SOGo version 5.12.7. This flaw allows remote code execution by embedding malicious SVG objects within ICS calendar invitations. The vulnerability is actively being exploited in real-world attacks, as evidenced by its appearance on VirusTotal. Alinto SOGo is an open-source webmail and groupware platform used by organizations to manage email, calendars, contacts, and scheduling. The vulnerability stems from SOGo's improper handling of the DESCRIPTION field within ICS files. This field is rendered without adequate sanitization or Content Security Policy enforcement. When a calendar invite includes an SVG payload with JavaScript event handlers, the browser executes the script within the SOGo webmail context. This script execution happens automatically when a user views the calendar, even without direct interaction. The impact of this vulnerability is significant, providing attackers with full read access to a victim's mailbox. This can lead to credential theft via phishing, hijacking of password manager autofill, and exfiltration of all email content and metadata. Attackers can also extract contact lists and calendar data. Users are strongly advised to upgrade to SOGo version 5.12.8 or a later version. This newer version fixes the vulnerability by sanitizing ICS DESCRIPTION content and enforcing stricter handling of embedded SVG and HTML.

https://kb.cert.org/vuls/id/487613 kb.cert.org

RSS Hunter • Aug 6

VU#243636: VPS.org one-click deployment templates contain multiple vulnerabilities

VPS.org's one-click deployment templates suffer from multiple vulnerabilities due to static configurations. The Supabase template exposes PostgreSQL to all network interfaces with a hard-coded password, allowing remote attackers to gain superuser access. This unpatched vulnerability enables data theft, modification, denial of service, and persistence. The Zulip template also has a hard-coded application key and a default database password, facilitating session forgery and authentication bypass. Furthermore, it defaults to unencrypted HTTP traffic, exposing sensitive data. These vulnerabilities grant attackers total control over affected systems. VPS.org has not yet released a patch for these issues. Users are strongly advised to change default passwords and secrets before production deployment. Implementing firewalls, network segmentation, and HTTPS are crucial mitigation steps. Simon Gajdosik reported these vulnerabilities.

https://kb.cert.org/vuls/id/243636 kb.cert.org

RSS Hunter • Jul 31

VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Six critical vulnerabilities have been identified in the SGLang project, an open-source framework for serving AI models. These vulnerabilities include unauthenticated remote code execution, server-side request forgery, and local file reading capabilities. Additionally, credential leakage and model weight exfiltration are possible through specific endpoints. Most of these vulnerabilities do not require authentication to exploit. At the time of this report, no patches have been released by the SGLang maintainers, and attempts to coordinate have been unsuccessful. One RCE vulnerability arises from bypassing SafeUnpickler's denylist, allowing arbitrary command execution. Another RCE is present when the dumper subsystem is enabled, permitting sandbox escapes. The multimodal generation endpoint is susceptible to SSRF and local file reads due to unsanitized image URL inputs. Loading model weights from HuggingFace repositories also presents an RCE risk via pickle deserialization. The server_info endpoint can leak API keys and SSL key information. Finally, model weights can be exfiltrated if no API keys are configured. Until patches are available, users are advised to restrict network access, implement network segmentation, and disable unused endpoints.

https://kb.cert.org/vuls/id/281278 kb.cert.org

RSS Hunter • Jul 30

VU#790363: foreUP golf management platform's web API contains multiple vulnerabilities

Two vulnerabilities were discovered in Golf Compete foreUP's REST API. The first vulnerability exposed merchant API credentials directly within customer record responses. These credentials, including username, password, and merchant ID, allowed any user to access the payment processor account. Furthermore, these credentials were identical for all customers at the same facility. The second vulnerability involved a missing object-level authorization check. This flaw, also known as Broken Object Level Authorization and Insecure Direct Object References, permitted users to retrieve any customer's full profile by altering the golfer_id in API requests. This included sensitive information like personal details, payment tokens, and transaction history. Combining both vulnerabilities, an attacker could obtain merchant credentials from any customer's record. With a single low-privilege customer account, one could access any customer's profile, stored payment tokens, and billing history. The shared web API meant all facilities using foreUP were affected. A customer from one facility could access merchant information from another. Thankfully, foreUP confirmed on July 26, 2026, that both vulnerabilities have been fixed. Users are advised to remain vigilant for phishing and identity theft.

https://kb.cert.org/vuls/id/790363 kb.cert.org

RSS Hunter • Jul 30

VU#293714: Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

A vulnerability has been discovered in Develar's app-builder, a command-line build tool used to package and distribute application bundles for macOS, Windows, and Linux. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior in the zipx.Unzip extraction routine. This allows an attacker to overwrite arbitrary files on macOS systems using Apple File System (APFS) by crafting ZIP archives that combine Unicode normalization collisions with malicious symlinks. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges and can result in loss of integrity, denial of service, or potential code execution. Develar's app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories, and several projects have already mitigated their exposure. A complete remediation requires fixing the vulnerability at its source, and a GitHub Pull Request has been developed to provide downstream customers with a reference fix. The Pull Request addresses the symlink-following variant of the vulnerability by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. The reporter, Tomas Illuminati, has assisted many downstream vendors and developers in mitigating this issue, and Electron-Userland has responded quickly and implemented a mitigation to protect their downstream users. The vulnerability can be exploited by combining Unicode normalization collisions with symlink-following behavior, allowing an attacker to bypass path-validation checks and redirect writes outside the intended extraction directory. The CERT/CC has prepared a vulnerability note to inform users of the issue and provide guidance on mitigation and remediation. Overall, the vulnerability has significant implications for the security of macOS systems using APFS, and users are advised to take steps to mitigate their exposure.

https://kb.cert.org/vuls/id/293714 kb.cert.org

RSS Hunter • Jul 29

VU#305509: OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

A vulnerability has been discovered in the OPeNDAP Hyrax software solution. This vulnerability allows a remote attacker to cause the application to communicate with unauthorized remote systems. It is classified as a Server Side Request Forgery (SSRF) and credential disclosure issue. The vulnerability stems from unvalidated HTTP redirects that bypass normal security checks. Hyrax fails to re-validate redirect destinations against its AllowedHosts list. Consequently, it can be tricked into connecting to untrusted or internal networks. Additionally, user authentication tokens, such as Echo-Token, may be leaked to attacker-controlled endpoints. Successful exploitation can grant attackers access to internal services not meant for public access. If a user is authenticated, their credentials could be compromised. Administrators are advised to review allowed host configurations and limit gateway endpoint exposure. A patch is expected soon from OPeNDAP, likely in version 1.18.0 or later.

https://kb.cert.org/vuls/id/305509 kb.cert.org

RSS Hunter • Jul 29

VU#141367: AT&T's Arris BGW210-700 gateway contains authentication bypass vulnerability in LAN-side management interface

The Arris BGW210-700 residential gateway, utilized by AT&T, has a critical security flaw in firmware versions 2.7.7 and earlier. This vulnerability, CVE-2026-16771, allows unauthenticated users on the local network to access sensitive configuration data and alter device settings. The web management interface bypasses server-side authentication, relying only on client-side code, which can be easily circumvented. An attacker can exploit this to retrieve the WiFi password in plaintext and modify network configurations. Multiple diagnostic and configuration pages are affected, including those for WiFi settings and WAN parameters. The impact includes unauthorized network access and manipulation. Fortunately, most devices should have received automatic firmware updates from ISPs, rendering them unaffected. Users can check their firmware version through the device's web interface. It is recommended to confirm automatic update functionality with the ISP. Practicing good network hygiene, like isolating devices and monitoring for unknown clients, can further mitigate risks.

https://kb.cert.org/vuls/id/141367 kb.cert.org

RSS Hunter • Jul 28

VU#492466: Logto Identity Platform has authentication and authorization failures in core protocol handling

Logto, an identity and access management system, suffers from multiple vulnerabilities in its authentication and authorization pipeline. These flaws weaken security for SaaS and AI applications using OIDC, OAuth 2.1, and SAML. One vulnerability allows account takeover by linking SSO identities to existing accounts without verifying the email. Another allows bypassing nonce verification in OIDC, potentially enabling replay attacks. Logto also mishandles SAML sessions, permitting replayed assertions to authorize multiple sign-ins due to separate lookup and deletion steps. Bypassing SAML Conditions checks allows attackers to circumvent time-based validation on forged or replayed assertions. Crucially, Logto fails to enforce MFA for SSO logins, allowing federated accounts to bypass local security. Inconsistent attribute comparisons in SSO flows can lead to incorrect identity resolution and unintended account linking. These issues collectively create pathways for unauthorized access, compromising account ownership and session integrity. Until patches are available, administrators can mitigate risks by managing email provisioning carefully, avoiding social SAML connectors, and enforcing MFA at upstream IdPs.

https://kb.cert.org/vuls/id/492466 kb.cert.org

RSS Hunter • Jul 23

VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Duplicati v2.3.0.1 has a critical vulnerability related to arbitrary code execution. This vulnerability occurs when Duplicati is installed in a directory other than the default C:\Program Files\Duplicati 2. An attacker with local user privileges who can write files to a non-default installation directory can exploit this. The MSI installer for Duplicati registers a LocalSystem service that executes binaries from the installation directory. When installed in the default location, Windows ACLs protect the directory, preventing unauthorized modifications. However, non-default installations lack these protections, allowing users to write malicious files. If a local attacker places a malicious DLL in such a directory, it can be loaded by the Duplicati service upon restart. This allows the attacker to execute arbitrary code with elevated NT AUTHORITY\SYSTEM privileges. To mitigate this, users should install Duplicati in the default directory or manually secure non-default locations with appropriate ACLs. Applying vendor patches and updating to the latest fixed version of Duplicati is also a crucial solution.

https://kb.cert.org/vuls/id/847406 kb.cert.org

RSS Hunter • Jul 22