New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Delinea Privilege Manager agent: Unauthenticated remote code execution

The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.

Delinea · Privilege Manager

Veeam Management Pack for Microsoft System Center: Remote code execution

The Collector service of the Veeam Management Pack for Microsoft System Center contains a vulnerability that allows a member of the Veeam Virtualization Extensions Users group to execute code remotely on the server. The attacker must already hold this group membership, so this is a privilege-escalation step rather than an anonymous entry point. Veeam rates the issue High (CVSS v4.0 8.8), and a successful attack could compromise the management server, which may affect backup infrastructure.

Veeam · Management Pack for Microsoft System Center

Veeam Management Pack: Remote code execution in Collector service

The Veeam Management Pack for Microsoft System Center Collector service contains a flaw that lets an authenticated domain user execute code remotely as the LocalSystem account. The vulnerability affects version 9.0 up to but not including 13.1.0.334 and is classified as CWE-502 (deserialization of untrusted data) by NVD-mirror data, while VulDB lists CWE-94. An attacker needs valid domain credentials but no user interaction, and a successful attack gives full control over the affected server, which is usually domain-joined and privileged.

Veeam · Management Pack for Microsoft System Center

Veeam Management Pack: Unauthenticated remote code execution in Virtualization Extensions

The Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center contains a flaw that allows an unauthenticated attacker to execute code remotely on the affected server. No valid credentials are required, and the CVSS v4.0 base score is 9.3 (critical). The component runs with elevated privileges and can reach hypervisor and backup infrastructure, so a compromise may have serious consequences. The vendor has published a fix, but version 9.x will not receive one.

Veeam · Management Pack for Microsoft System Center

WeGIA: Stored cross-site scripting in patient record history page

WeGIA, a web manager for charitable institutions, contains a stored cross-site scripting flaw in the textoProntuario field of the medical record history page (saude/historico_prontuarios.php). An attacker who can create or access a patient's medical record can store JavaScript that runs in the browser of another user who opens the affected history page. Successful exploitation can lead to session cookie theft and possible account compromise, depending on the victim's privileges.

LabRedesCefetRJ · WeGIA

SOCFortress CoPilot: Server-side template injection leading to code execution

CoPilot before 0.1.76 renders case-report templates with a non-sandboxed Jinja2 engine. A user with the lowest-privilege customer_user role can upload a manipulated template, and it is executed as Python code when an admin or analyst generates a report. In the reported deployment this allowed command execution as root, exposing data of all tenants and stored connector credentials. The PDF renderer additionally allowed local file reads and requests to internal services.

SOCFortress · CoPilot

Research and translation in progress – available shortly.

WeGIA: Insecure direct object references and missing CSRF checks

WeGIA, a web manager for charitable institutions, does not verify record ownership in its Controle classes and processes request parameters through extract($_REQUEST). Any authenticated user can view, change or delete records of other users, including personal identifiers, addresses, medical records, financial data and employee records. Some controllers also lack CSRF validation, so a malicious web page visited by a logged-in user can trigger changes using that user's session.

LabRedesCefetRJ · WeGIA

Lightdash: Path injection in unauthenticated dbt Cloud webhook

Lightdash, an open-source business intelligence platform, has a dbt Cloud webhook endpoint that accepts requests without authentication. Attacker-supplied accountId and runId values are inserted into the dbt Cloud API URL without sanitization, so path traversal can redirect the server's request, which carries the project's API key, to another path on cloud.getdbt.com. The attacker must know the project UUID, and the target must be a dbt Cloud IDE project. The advisory's claim of API key theft is not established by the evidence, and the CVSS and CWE ratings conflict between sources.

Lightdash · Lightdash

Docat: Arbitrary file upload in Upload API

Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker who can reach the API can overwrite sensitive configuration files or place malicious files on the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting. Whether an attacker needs a login or API key in a default setup is unknown.

docat-org · docat

OpenAM: Session token disclosure in CDSSO servlet

OpenAM, an access management solution, exposes a logged-in user's raw session token through its Cross-Domain Single Sign-On (CDSSO) servlet. An attacker who gets an authenticated victim to visit a crafted URL can receive the token and may hijack the session. Exploitation requires CDSSO to be enabled, which is common in multi-domain deployments, and a non-default configuration that the sources do not name.

Open Identity Platform · OpenAM

Research and translation in progress – available shortly.

GraphQL-core: Denial of service via memory leak in aborted validations

graphql-core, a Python port of the GraphQL.js reference implementation, leaks memory when a GraphQL document produces more than 100 validation errors. Each aborted validation adds frames to a shared exception object, so documents and validation contexts stay in memory for the lifetime of the process. An unauthenticated attacker can repeatedly send a small query to exhaust worker memory before execution, causing a denial of service, without disclosing or modifying data.

graphql-python · graphql-core

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

joserfc: Denial of service via unbounded JWE General JSON recipients array

joserfc is a Python library for JOSE standards. Before version 1.7.5, decrypt_json() processed every entry of a JWE General JSON recipients array without a count limit, performing one RSA private-key decryption per entry. An unauthenticated attacker who can submit JWE General JSON to an endpoint using an RSA key-management algorithm can choose the amount of CPU work per request and exhaust the service's CPU. The verify_all_recipients option does not limit this work, and there is no impact on confidentiality or integrity.

Authlib · joserfc

Nx @nx/maven and @nx/gradle: OS command injection via nx.json plugin options

The project-graph analyzers of the Nx plugins @nx/maven and @nx/gradle start processes through a shell and insert plugin options from nx.json into command arguments without sanitizing them. An attacker who can get a user or CI job to run nx in a hostile repository or pull request can execute arbitrary commands with that user's privileges. Workspaces that do not register either plugin are not exposed.

Nrwl · Nx

Research and translation in progress – available shortly.

Lightdash: Path traversal in unauthenticated dbt Cloud webhook

The dbt Cloud webhook of Lightdash accepts requests without authentication. Account and run identifiers from the request are inserted unsanitized into the dbt Cloud API URL, which is called with the project's API key, so path traversal changes the requested path on the fixed dbt Cloud host. An attacker who knows the projectUuid of a dbt Cloud IDE project can also create previews without authentication. Theft of the API key is claimed by the advisory but not confirmed by the available evidence. The UUID is not enumerable but can be exposed in shared or multi-tenant setups.

Lightdash · Lightdash

HashiCorp Boundary: Server-side request forgery in Vault credential store

HashiCorp Boundary and Boundary Enterprise contain a server-side request forgery in the Vault credential store integration. An authenticated user who can manage credential stores and credential libraries within a project can make the Boundary controller send requests to a destination of their choice and receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service.

HashiCorp · Boundary

Bricks Theme: Broken access control in load_popup_content REST endpoint

Bricks Theme 2.4 and earlier for WordPress exposes the load_popup_content REST endpoint without authentication or status checks. An anonymous attacker can request a public nonce and then iterate the popupId parameter to read draft and unpublished page content. The vulnerability affects any public WordPress site running a vulnerable version of the theme, and no user interaction is needed.

Bricks · Bricks Theme

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.