This entry reports on ThreatFox Indicators of Compromise (IOCs) dated 2026-10-08. It is categorized under OSINT, payload delivery, and network activity but lacks detailed technical information or specific indicators. No affected software versions or exploits in the wild are identified. The severity is assessed as medium based on the provided metadata.
Apache Struts contains a command injection vulnerability identified as CVE-2016-3081. This flaw allows remote attackers to execute arbitrary code via the method:prefix parameter when Dynamic Method Invocation is enabled. The vulnerability has been exploited in the wild, indicating active use by attackers. No specific affected versions or patch information is provided in the available data.
CVE-2015-5477 is a vulnerability in ISC BIND that causes data processing errors when handling TKEY DNS resource record requests. This flaw can lead to a denial of service by causing the BIND DNS server (named) to exit unexpectedly due to an assertion failure triggered by specially crafted DNS queries. The vulnerability affects multiple Red Hat Enterprise Linux versions, and patches have been released to address the issue. Exploitation in the wild has been observed.
ProFTPD contains an improper access control vulnerability that allows remote attackers to read and write arbitrary files using the site cpfr and site cpto commands. This vulnerability has been exploited in the wild and is considered high severity.
ONLYOFFICE Docs Server has a path traversal vulnerability (CVE-2021-3199) that occurs when JSON Web Tokens (JWT) are used. The flaw involves a /.. sequence in an image upload parameter, which could allow an attacker to execute remote code on the server. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Vikunja versions up to 2.5.0 have a vulnerability where the /api/v2 public authentication endpoints lack rate limiting, allowing unauthenticated attackers to perform unlimited credential guessing, account enumeration, and password-reset flooding attacks. This issue does not affect the /api/v1 endpoints, which are properly rate limited. The vulnerability has a high severity with a CVSS score of 7.5. The advisory is a duplicate and references GHSA-6rvj-qwjf-3m4q. No patch links are provided in this data.
Vikunja versions up to 2.5.0 expose the raw TOTP shared secret after enrollment via specific API endpoints without requiring re-authentication. This allows attackers with a valid access token to retrieve the secret and generate valid two-factor authentication codes indefinitely, potentially leading to account takeover. The vulnerability has a medium severity with a CVSS score of 4.3.
Vikunja versions 1.0.0 through 2.5.0 have an API token scope bypass vulnerability in task read endpoints. The issue arises because the authorization process does not properly inspect the 'expand' query parameter, allowing attackers with limited token scopes to access restricted data such as comments, reactions, and time entry counts without proper permission checks. This vulnerability has a medium severity rating with a CVSS score of 4.3.
Vikunja versions up to 2.5.0 have an authentication bypass vulnerability due to missing rate limiting on CalDAV and feeds BasicAuth endpoints. This allows remote unauthenticated attackers to perform unlimited credential-guessing attempts against specific routes, bypassing anti-brute-force protections and potentially compromising password-only accounts. The vulnerability has a high severity with a CVSS score of 7.5.
Vikunja versions up to 2.5.0 have a vulnerability in the avatar and project-background upload endpoints where pixel decode limits are not enforced. This allows authenticated users to upload crafted images that decode to very large pixel counts, consuming excessive CPU and memory resources. The flaw can lead to denial of service through resource exhaustion caused by repeated or concurrent uploads. This vulnerability has a CVSS score of 6.5, indicating a high severity impact on availability.
Vikunja versions up to 2.5.0 have a vulnerability where authenticated users can enumerate all teams and their members by attaching arbitrary team IDs to projects. This occurs because the application fails to validate team access properly when teams are attached to projects. The vulnerability allows disclosure of team rosters, including member names and admin flags, for teams the user is not authorized to view. This issue is tracked as a medium severity vulnerability with a CVSS score of 4.3. The advisory is a duplicate and references GHSA-39p5-2wrr-xh29 for the original report.
Vikunja versions up to 2.5.0 have a vulnerability in the v2 API where link-share tokens are not properly validated. This allows attackers with read-only share links to enumerate project users and confirm arbitrary usernames via the global search endpoint. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Vikunja versions up to 2.5.0 have a vulnerability where the application does not limit archive expansion during data import. Authenticated users can upload specially crafted compressed files that expand massively in memory and disk usage, causing denial of service by exhausting server resources. This vulnerability is fixed starting from version 2.6.0.
Vikunja versions before 2.6.0 have a resource exhaustion vulnerability in the task-filter API endpoint. This flaw allows authenticated users to submit deeply nested filter expressions without limits on recursion depth, causing memory exhaustion and termination of the API process. The vulnerability is identified as CWE-674 and has a CVSS 3.1 score of 6.5 (high severity). The advisory is a duplicate and has been withdrawn in favor of GHSA-xxc3-xpmc-vmvr. No patch links are provided in this advisory.
Vikunja versions before 2.6.0 have a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint. This flaw allows authenticated attackers to upload multipart CSV files with extremely large numbers of tiny records, which can exhaust process memory and cause the API service to terminate. The vulnerability is identified as CWE-400 (Uncontrolled Resource Consumption).
Vikunja versions 2.5.0 and later before 2.6.0 have a resource exhaustion vulnerability in the Planka migrator. Authenticated attackers can cause denial of service by submitting migration requests that cause excessive memory use, leading to out-of-memory conditions in the API.
Multiple vulnerabilities in BlueZ, the Linux Bluetooth protocol stack, include a flaw in parsing AVRCP profile responses that may lead to out-of-bounds memory access. These issues can cause crashes, denial of service, or potentially expose sensitive information. The vulnerabilities affect several Ubuntu LTS releases and have been addressed by updates provided by Ubuntu.
A stack-based buffer overflow vulnerability (CVE-2026-80186) exists in BlueZ, the Linux Bluetooth protocol stack. A remote attacker within Bluetooth range can send a specially crafted Extended Inquiry Response (EIR) packet during Bluetooth discovery, causing a buffer overflow. This may result in denial of service by crashing the bluetoothd service or potentially allow arbitrary code execution. Multiple Ubuntu LTS releases with specific BlueZ package versions are affected. A security update is available to address this issue.
Vikunja versions up to 2.4.0 have a principal-type confusion vulnerability where link-share principals are incorrectly treated as user principals during permission checks. This allows attackers with a link-share JWT to remove users from teams, delete bot users, and read team rosters due to ID collisions. The vulnerability has a high severity with a CVSS score of 7.5. This advisory is a duplicate and references GHSA-32r8-5843-4qw2. No patch links are provided, and no known exploits are reported in the wild.
A vulnerability in BlueZ's Audio/Video Remote Control Profile (AVRCP) allows a malicious Bluetooth device to cause an out-of-bounds memory read by sending crafted GetFolderItems responses. This can crash the bluetoothd daemon, resulting in denial of service and potential exposure of sensitive heap memory. Exploitation requires user interaction to pair with the malicious device. Multiple Ubuntu package versions are affected, and patches have been released.