CWE-454 vulnerabilities

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.

pam_usb versions prior to 0.9.2 are vulnerable to environment variable injection via the XRDP_SESSION, DISPLAY, and TMUX variables. These variables affect local-check logic determining session locality in PAM modules running with elevated privileges. An attacker with local access can manipulate these environment variables to influence authentication decisions. This vulnerability has been fixed in version 0.9.2.

External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.

IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper initialization of critical variables.