CVE-2025-23800

A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.

A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) by bypassing the Safemode sandbox within the templating engine. Due to improper handling of delegated methods, the attacker can append unauthorized functions to the allowed execution list, enabling arbitrary command execution on the hosting server.

In Apache HTTP Server's mod_ssl from 2.4.0 through 2.4.68, improper privilege management via SSLRequire and file-related expressions may lead to unauthorized access.

In Apache HTTP Server's mod_http2 from 2.4.0 through 2.4.68, a Use After Free vulnerability exists via shared session->bbtmp re-entrancy.

In Apache HTTP Server's mod_rewrite from 2.4.0 through 2.4.68, a Use After Free vulnerability exists when using lookahead (%{LA-U:HTTP:...}).

The Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products does not properly enforce authentication. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.

Classroom 50 prior to version 1.11.0, when running `gh teacher download`, clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a symlink could redirect the teacher's write to an arbitrary path (e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file), with attacker-controlled bytes. This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization.

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master.

The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.