Threats affecting pkg:bitnami/python

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm_templates module plus a _target_ name that is imported and instantiated when victims call AutoRunner or import_bundle_algo_history, executing code under default configuration.

ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser.

ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.

ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents.

Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a path on the same host without matching auth-tls settings, Traefik falls back to default TLS options, letting unauthenticated attackers reach backends requiring client certificates.

Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.

Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request.

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.

CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The secret therefore has at most 2**32 possible values, and one signed cookie is enough to test each candidate offline. An attacker who obtains a single session cookie can recover the secret and sign cookies for any user, including an administrator.

CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sent in the X-Session-Cookie header is accepted however old it is. A session cookie that leaks through a log, a Referer header or browser history authenticates as its user indefinitely.

CallBackery versions prior to 0.62.0 for Perl create a temporary configuration database dump in /tmp with insecure permissions. The dump file is world-readable and not removed after creation, exposing sensitive data including password hashes. A local user can exploit this by reading the dump or redirecting it via a symlink to a file of their choosing.

CallBackery versions prior to 0.62.0 use an insecure method to encrypt configuration backups by deriving the AES key directly from a padded password without salt or key derivation. This allows an attacker who obtains a backup to perform fast offline password guessing at raw AES speed, potentially recovering all credentials stored in the backup.

CallBackery versions before 0.62.0 for Perl contain an OS command injection vulnerability. This occurs because the restoreConfigBlob() function feeds a database dump from a backup to the sqlite3 shell, which executes lines starting with a dot as shell commands. An attacker who can supply a backup to be restored can execute arbitrary OS commands as the application user.

CallBackery versions before 0.62.0 for Perl contain a vulnerability that allows denial of service via inefficient regular expression complexity. The issue arises from unquoted interpolation of the request path as a regular expression in the before_dispatch hook, which processes PATH_INFO from client requests under CGI, FastCGI, and PSGI environments. An unauthenticated attacker can send a crafted request with a backreference in the path that causes exponential backtracking, tying up server worker processes for extended periods.

CallBackery versions prior to 0.62.0 for Perl contain a log injection vulnerability due to improper output neutralization of control characters in login names. The login RPC method does not require authentication, allowing an attacker to inject forged log entries by including newline characters in the login name. This can result in misleading log records, such as fake successful administrator logins from arbitrary IP addresses.

CallBackery versions before 0.62.0 for Perl contain a permissive regular expression vulnerability in the createRxValidator function. The function is intended to anchor patterns strictly but fails to group alternations properly, allowing unintended values to pass validation. This flaw permits authenticated users to submit values that should be rejected, potentially leading to unsafe data being written into generated configuration files.

CallBackery versions prior to 0.62.0 for Perl improperly expose sensitive information through the getUserConfig function. Non-administrative users can access their own password hash and administrator-only notes, which should be restricted. This flaw allows attackers with a session token to retrieve password hashes and potentially crack them offline.