Posted by Nir Yehoshua on Sep 03

Hello Full Disclosure list,

Cipher Security Labs has published technical details for three
High-severity vulnerabilities affecting HP Easy Start for macOS. The
issues were coordinated with HP and are addressed in HP Easy Start
2.16.7.260722 and later under HPSBPI04124.

Research title:
Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries

Affected product:
HP Easy Start for macOS

Affected versions:
Versions prior to...

Posted by Ron E on Sep 03

Next.js 16.4.0-canary.13 contains a DNS rebinding TOCTOU Server-Side
Request Forgery vulnerability in the Image Optimizer's fetchExternalImage()
functionality.

Next.js attempts to prevent requests to private network resources by
resolving the supplied hostname and checking the resulting addresses using
isPrivateIp():

const records = await lookup(hostname, {
family: 0,
all: true,
hints: ALL,
})

const privateIps = records.map((record)...

Posted by Ron E on Sep 03

Description

O-CMS version 1.0.0 contains an authenticated OS command injection
vulnerability in the AI CLI configuration functionality. An authenticated
attacker with sufficient privileges can supply shell metacharacters and
additional commands through the ai_cli_script parameter of
/admin/settings/save.

When the configured AI provider is subsequently tested through
/admin/settings/test-ai, the attacker-controlled CLI value is executed in a...

Posted by Ron E on Sep 03

Description

Flextype CMS contains a remote code execution vulnerability in the
interaction between the Entries API and Shortcodes::registerShortcodes().
The /api/v1/entries endpoint accepts an attacker-controlled entry
identifier that can contain path traversal sequences, allowing content
containing PHP code to be written outside the intended entries directory.

The /api/v1/query endpoint subsequently permits an attacker-controlled path
to reach...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains a stored server-side request forgery
(SSRF) vulnerability in its shortcode-processing functionality.

Attacker-controlled entry fields can be automatically processed by
Flextype's shortcode parser. The built-in fetch shortcode accepts an
attacker-controlled resource and passes the resulting value to the
server-side fetch() helper without sufficient destination restrictions.

An attacker...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability
in its stored shortcode processing functionality. Attacker-controlled entry
fields are automatically processed by the shortcode parser when global
shortcode processing is enabled.

The built-in filesystem shortcode accepts a file path and returns the
contents of the specified file without restricting the path to an approved
application directory.

An attacker...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability
caused by the interaction between globally processed entry expressions, the
mutable registry object exposed to expressions, and the PHP entry directive.

Attacker-controlled entry fields are automatically processed as expressions
during entry retrieval. The expression environment exposes the
application's mutable registry() object, allowing an expression...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains an authentication validation
vulnerability in the API request-processing functionality. API endpoints
may declare access_token as a required parameter, but the
required-parameter validation only verifies that the corresponding key
exists in the supplied request data.

Authentication verification is subsequently performed inside an isset($data
['access_token']) condition. In PHP, isset()...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains a path traversal vulnerability in the
Entries copy functionality. An authenticated remote attacker can supply
directory traversal sequences within both the source id and destination
new_id parameters submitted to /api/v1/entries/copy.

Flextype constructs entry directory paths by directly concatenating the
supplied entry identifier with the configured entries directory without
sufficiently...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains a server-side request forgery (SSRF)
vulnerability in the expression-processing functionality exposed through
the /api/v1/query endpoint. An authenticated remote attacker can supply an
arbitrary URL to the exposed fetch() function, causing the Flextype server
to initiate an outbound HTTP request to an attacker-controlled destination.

The application does not sufficiently restrict the destination...

Posted by Ron E on Sep 03

Description

Flextype CMS v1.0.0-alpha.3 contains a stored arbitrary expression
injection vulnerability in the Entries ExpressionsDirective. An
authenticated remote attacker with sufficient privileges to create or
modify entries can persist arbitrary expression syntax within an entry
field. When the affected field is subsequently retrieved or processed,
Flextype passes the stored value to parsers()->expressions()->parse(),
causing the...

Posted by Ron E on Sep 03

*Description:*
Payara Server contains a vulnerability in its Server-Side Includes (SSI)
implementation that allows arbitrary operating system command execution via
the #exec directive. The issue occurs because user-controlled SSI
directives are passed directly to Runtime.exec() without validation,
sanitization, or restriction. An attacker who can cause the server to
process an SSI file (e.g., .shtml) can execute arbitrary OS commands with
the...

Posted by Ron E on Sep 03

Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms
that rely on attacker-controlled reflection, dynamic class loading, and
unsafe deserialization. These endpoints allow remote clients to perform
arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke
EJB business methods via reflection without sufficient authorization
enforcement or input restriction.

Both the deprecated InvokeEJBServlet and the...

Posted by Ron E on Sep 03

*Description:*
A stack-based buffer overflow exists in the Linux Industrial I/O (IIO)
userspace utility lsiio. The vulnerability occurs in the
find_type_by_name() function, where the program reads an unbounded string
from a filesystem-backed attribute into a fixed-size stack buffer using
fscanf("%s", ...).
If a crafted or oversized attribute value is present, the unbounded read
causes a write beyond the bounds of the destination stack...

Posted by Ron E on Sep 03

*Description:*
A stack-based buffer overflow vulnerability exists in the redirect CGI
program distributed with thttpd. The vulnerability is caused by unsafe
string concatenation when constructing redirect URLs using
attacker-controlled CGI environment variables. A remote, unauthenticated
attacker can trigger the vulnerability via a crafted HTTP request,
resulting in a crash of the CGI process and denial of service. In
environments lacking modern...

FreePBX 17.0.2 - Remote Code Execution (RCE)

Metabase 0.61.0 - Authenticated Remote Code Execution

EVerest 2025.9.0 - DoS

Bludit CMS 3.20.0 - Reflected Cross-Site Scripting

PodcastGenerator 3.2.9 - Stored XSS