Vulnerabilities

Scriban before 7.0.0 (affected versions

Scriban before 7.0.0 (affected

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.

stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1.

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: algif_skcipher - force synchronous processing on trees without ctx-&gt;state<br /> <br /> The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx-&gt;iv<br /> directly into the skcipher request. After io_submit() the socket lock is<br /> dropped and the request is processed asynchronously, so a concurrent<br /> sendmsg(ALG_SET_IV) can overwrite ctx-&gt;iv and make the in-flight request<br /> run under an attacker-controlled IV. For CTR/stream modes this is<br /> IV/keystream reuse and lets an unprivileged user recover the plaintext of<br /> a concurrent operation.<br /> <br /> Snapshotting ctx-&gt;iv into per-request storage for the async path is not<br /> sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -<br /> the MSG_MORE inter-chunk IV chaining is carried solely by the in-place<br /> req-&gt;iv writeback, which a snapshot redirects into per-request memory that<br /> af_alg_free_resources() releases on completion, silently producing wrong<br /> output. Writing the IV back from the completion callback instead is not<br /> possible either: that would require lock_sock() there, but the callback can<br /> run in softirq/atomic context, so it must not sleep.<br /> <br /> Make the operation synchronous instead, which removes both the IV race and<br /> any writeback race. This is equivalent to the upstream resolution, commit<br /> fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the<br /> AIO socket path across net/ entirely and so produces the same end state for<br /> this file. This patch deviates from that commit deliberately: rather than<br /> removing AIO socket support tree-wide, which would be far too invasive for<br /> stable, it removes only the AIO branch in crypto/algif_skcipher.c.<br /> io_submit() now completes synchronously; AF_ALG async is rarely used in<br /> practice.<br /> <br /> The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,<br /> and is left alone to keep the fix minimal.<br /> <br /> Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000<br /> after the change; MSG_MORE chunked CTR output bit-identical to single-shot.