Threats affecting pkg:bitnami/pillow

Vvveb CMS versions prior to 1.0.8.7 contain an improper authorization vulnerability (CWE-285) in the admin/auth-token endpoint. This allows an authenticated administrator to read and overwrite API tokens belonging to other administrators. The issue has been fixed in version 1.0.8.7.

Vvveb CMS versions prior to 1.0.8.7 have an authentication bypass vulnerability in the password reset functionality due to insufficient validation of user and token GET parameters. This flaw allows attackers to bypass authentication controls. The issue is patched in version 1.0.8.7.

WHartTest versions 2.2.0 through 2.8.1 have a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet. Authenticated users can manipulate the project_pk parameter to access, modify, delete, or trigger scheduled tasks belonging to other projects. This includes running tasks immediately and reading execution logs.

Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to manipulate the client-supplied chatId parameter, enabling them to move messages with arbitrary content into another user's AI chat history. The vulnerability is fixed in version 0.99.0.

Tamery versions from 0.32.0 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in batch requests. The issue is fixed in version 0.99.0.

Songloft versions 2.9.0 up to but not including 2.13.6 contain a vulnerability due to hardcoded administrator credentials (admin/admin). This flaw allows attackers on the same network to authenticate as an administrator via the /api/v1/auth/login endpoint. Exploitation enables modification of library and configuration settings and installation of JavaScript plugins running in QuickJS. The vulnerability has a high severity with a CVSS 4.0 score of 8.7. The issue is fixed in version 2.13.6.

ShowDoc versions up to and including 3.9.5 have an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint. The endpoint only verifies edit permission for the first entry ID supplied, allowing authenticated attackers to manipulate the request by placing their own entry ID first and appending other users' entry IDs. This enables attackers to delete parameter-description entries belonging to other users without proper authorization.

MuseBot versions prior to 2.0.0 contain a critical authentication bypass vulnerability due to the use of a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing session cookies with the default key, granting full administrative access. Exploitation enables attackers to read sensitive data such as password hashes, chat records, and bot configurations, and to stop bots. The vulnerability is fixed in MuseBot version 2.0.0.

Blossom versions up to 1.17.1 have an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService only filters queries by folder ID, enabling attackers to supply another user's folder ID to endpoints such as /folder/info, /folder/upd, /folder/open, or /folder/del. Exploitation can lead to unauthorized reading of storage paths, renaming, toggling visibility, or deletion of folders.

PowerDNS-Admin versions up to 2026.08.1 have an authorization bypass vulnerability allowing authenticated users with User-role permissions to refresh secondary DNS zones they should not access by manipulating the 'domain' field in the JSON request body. This flaw enables attackers authorized for any single zone to trigger zone transfers (axfr-retrieve) of other users' secondary zones and infer the existence of those zones based on response differences.

FilePress versions up to 3.0.1 have an authorization bypass vulnerability in the dzz/pichome/library component. Authenticated users can manipulate folders belonging to other libraries because the permission check only verifies membership in any library, not the specific target library. This allows attackers who know another library's appid or folder id to perform folder operations such as deletion, renaming, or reading folder data.

CoreShop by CoreUnion versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw arises from improper neutralization of special elements in the 'order' parameter used in an ORDER BY clause, allowing anonymous attackers to inject subqueries. Exploitation can lead to extraction of member accounts and orders via boolean-based or time-based blind SQL injection techniques.

CoreShop versions up to 1.5.5 have an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint. The flaw arises from improper validation of the 'order' parameter used in the ORDER BY clause, allowing attackers to inject subqueries. This can lead to extraction of sensitive data such as member accounts and orders using blind SQL injection techniques.

DataCap versions up to and including 2025.1.1 contain a missing authorization vulnerability that permits any authenticated user, including self-registered accounts, to escalate privileges by invoking administrative APIs. Specifically, attackers can send PUT requests to the /api/v1/user/allocationRole endpoint to assign themselves the administrator role, thereby gaining full control over the instance.

Nging versions up to and including 5.3.5 have an information disclosure vulnerability where authenticated backend users with low privileges can enumerate host directories via the /user/autocomplete_path endpoint. This endpoint is public-tagged and allows arbitrary path queries, enabling users without file-manager permissions to confirm the existence of files readable by the Nging process.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the FriendController.friendList endpoint. Authenticated users can bypass authorization checks by supplying a user ID (uid) parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper permission.

HuLa-Server versions up to 3.0.7 have an authorization bypass vulnerability in the FeedController.delFeed function. Authenticated users can delete moments belonging to other users by providing arbitrary feedId values in POST requests to /feed/del. This allows attackers to remove other users' moments, including associated media, comments, and likes.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the PrivacyController. Authenticated users can exploit this flaw by supplying another user's uid in GET or POST requests to the /privacy endpoint, allowing them to read and modify that user's privacy settings without proper authorization checks.

Orchard CMS versions 1.10.3 through 1.11 have an improper authorization vulnerability in the MediaLibraryService.CheckMediaFolderPermission() function. This flaw allows authenticated users with Author or Contributor roles to access media items belonging to other users. Exploitation enables attackers to display, clone, and delete media items by content ID and delete arbitrary media folders via the FolderController.Delete() method.

Tencent BlueKing CMDB (bk-cmdb) versions up to 3.14.6 have a missing authorization vulnerability that allows authenticated users to access host information from other businesses. This occurs via the POST /api/v3/hosts/search/asstdetail endpoint, which improperly skips authorization checks, enabling unauthorized host data retrieval.