WeGIA, a web manager for charitable institutions, contains a stored cross-site scripting flaw in the textoProntuario field of the medical record history page (saude/historico_prontuarios.php). An attacker who can create or access a patient's medical record can store JavaScript that runs in the browser of another user who opens the affected history page. Successful exploitation can lead to session cookie theft and possible account compromise, depending on the victim's privileges.
LabRedesCefetRJ · WeGIA
CoPilot before 0.1.76 renders case-report templates with a non-sandboxed Jinja2 engine. A user with the lowest-privilege customer_user role can upload a manipulated template, and it is executed as Python code when an admin or analyst generates a report. In the reported deployment this allowed command execution as root, exposing data of all tenants and stored connector credentials. The PDF renderer additionally allowed local file reads and requests to internal services.
SOCFortress · CoPilot
Research and translation in progress – available shortly.
WeGIA, a web manager for charitable institutions, does not verify record ownership in its Controle classes and processes request parameters through extract($_REQUEST). Any authenticated user can view, change or delete records of other users, including personal identifiers, addresses, medical records, financial data and employee records. Some controllers also lack CSRF validation, so a malicious web page visited by a logged-in user can trigger changes using that user's session.
LabRedesCefetRJ · WeGIA
Lightdash, an open-source business intelligence platform, has a dbt Cloud webhook endpoint that accepts requests without authentication. Attacker-supplied accountId and runId values are inserted into the dbt Cloud API URL without sanitization, so path traversal can redirect the server's request, which carries the project's API key, to another path on cloud.getdbt.com. The attacker must know the project UUID, and the target must be a dbt Cloud IDE project. The advisory's claim of API key theft is not established by the evidence, and the CVSS and CWE ratings conflict between sources.
Lightdash · Lightdash
Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker who can reach the API can overwrite sensitive configuration files or place malicious files on the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting. Whether an attacker needs a login or API key in a default setup is unknown.
docat-org · docat
OpenAM, an access management solution, exposes a logged-in user's raw session token through its Cross-Domain Single Sign-On (CDSSO) servlet. An attacker who gets an authenticated victim to visit a crafted URL can receive the token and may hijack the session. Exploitation requires CDSSO to be enabled, which is common in multi-domain deployments, and a non-default configuration that the sources do not name.
Open Identity Platform · OpenAM
Research and translation in progress – available shortly.
graphql-core, a Python port of the GraphQL.js reference implementation, leaks memory when a GraphQL document produces more than 100 validation errors. Each aborted validation adds frames to a shared exception object, so documents and validation contexts stay in memory for the lifetime of the process. An unauthenticated attacker can repeatedly send a small query to exhaust worker memory before execution, causing a denial of service, without disclosing or modifying data.
graphql-python · graphql-core
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
joserfc is a Python library for JOSE standards. Before version 1.7.5, decrypt_json() processed every entry of a JWE General JSON recipients array without a count limit, performing one RSA private-key decryption per entry. An unauthenticated attacker who can submit JWE General JSON to an endpoint using an RSA key-management algorithm can choose the amount of CPU work per request and exhaust the service's CPU. The verify_all_recipients option does not limit this work, and there is no impact on confidentiality or integrity.
Authlib · joserfc
The project-graph analyzers of the Nx plugins @nx/maven and @nx/gradle start processes through a shell and insert plugin options from nx.json into command arguments without sanitizing them. An attacker who can get a user or CI job to run nx in a hostile repository or pull request can execute arbitrary commands with that user's privileges. Workspaces that do not register either plugin are not exposed.
Nrwl · Nx
Research and translation in progress – available shortly.
The dbt Cloud webhook of Lightdash accepts requests without authentication. Account and run identifiers from the request are inserted unsanitized into the dbt Cloud API URL, which is called with the project's API key, so path traversal changes the requested path on the fixed dbt Cloud host. An attacker who knows the projectUuid of a dbt Cloud IDE project can also create previews without authentication. Theft of the API key is claimed by the advisory but not confirmed by the available evidence. The UUID is not enumerable but can be exposed in shared or multi-tenant setups.
Lightdash · Lightdash
HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.
HashiCorp · Boundary
Bricks Theme 2.4 and earlier for WordPress exposes the load_popup_content REST endpoint without authentication or status checks. An anonymous attacker can request a public nonce and then iterate the popupId parameter to read draft and unpublished page content. The vulnerability affects any public WordPress site running a vulnerable version of the theme, and no user interaction is needed.
Bricks · Bricks Theme
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
pypdf, a pure-Python PDF library, can consume excessive memory when opening a crafted PDF whose cross-reference streams declare very large entry counts. An attacker can use this to cause a denial of service in applications that parse untrusted PDF files. No authentication is required, and the CNA rates the CVSS 4.0 score at 7.1 (High), with availability as the only impact.
py-pdf · pypdf
