CVE Vulnerability Catalog

Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account. The application lacked a durable setup-complete marker independent of the mutable user store.

FileRise prior to 3.16.0 does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename.

Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not.

Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend.

A vulnerability has been found in OAID Tengine up to 1.12.0 affecting the function get_tm_file_model in source/serializer/tmfile/tm2_serializer.c of the tmfile Model Loader component. Manipulation of the offset_root argument leads to an out-of-bounds read. The attack can be launched remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6 affecting the function shouldSkipTargetPath in internal/runner/runner.go of the Static Scanner component. Manipulation results in protection mechanism failure. The attack requires local access and the exploit has been publicly released.

In OpenSIPS up to 3.6.8/4.0.1, the rtpproxy_offer/rtpproxy_answer function of the rtpproxy component causes an out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 or 4.0.2 resolves the issue.

A SQL injection vulnerability was found in cemtan sar2html 4.0.0, in the updateDb function of sar2html.py within the Archive Processing component. Manipulation of the s2host argument allows SQL injection. The attack can be launched remotely.

FileRise Pro prior to 3.24.0 returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug via /api/pro/portals/get.php. The response includes the internal storage folder path, client contact email, form settings, and upload-policy details, while the separate publicMeta.php endpoint intentionally exposes only curated branding data.

FileRise before 3.23.0 validates archive entry names but extracts them directly into the destination before validating resolved paths. If the destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission can place an archive entry beneath the link and overwrite or delete an external file.

Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker able to obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled.

In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. An authenticated non-administrator with a valid CSRF token and inherited edit permission can create files outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root.

FileRise before 3.23.0 permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account has no TOTP secret. The newly generated secret is persisted and activated before a TOTP code verifies possession, allowing an attacker controlling an existing session to disable or enroll a second factor.

FileRise before 3.23.0 verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker with the target account's valid primary credential who captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes.

FileRise before 3.23.0 in /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A user who owns a source folder can move that tree beneath another user's folder or into the root namespace, and the operation rekeys ownership and ACL records to the new path.

Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit.

A post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in SonicWall Network Security Manager (NSM) on-prem. Under specific conditions, a remote authenticated attacker could execute arbitrary OS commands, resulting in remote code execution.

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. Exploitation requires access to the PAN-OS management interface.

An improper input handling vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.

A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode.