Advisory Catalog

Contao: Cross-site scripting in the comments bundle

Contao: Path traversal in the images controller

Contao: The registration module re-sends activation mails

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

pyLoad: Api.set_user_permission never invalidates the target's session

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad has an authentication bypass in API key validation (check_apikey cache)

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination