Monthly
Authorization bypass in OpenStack Aodh's alarm list API allows any authenticated user with the reader role to enumerate alarms across all projects by exploiting a logic flaw where passing `all_projects=false` removes the project-scoping key entirely rather than restricting scope - exposing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs from foreign projects. The leaked webhook URLs directly enable a second-stage attack against OpenStack Watcher, whose webhook trigger endpoint has enforced no authorization since the Ussuri release (Watcher 4.0.0), permitting any authenticated user who obtains a webhook URL to start EVENT audits and execute associated action plans against arbitrary projects. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.4 reflects the chained confidentiality-then-cross-system-integrity impact of these two related flaws.
Firefox's Process Sandboxing component allows information disclosure and partial sandbox escape when a user visits a specially crafted webpage, affecting all Firefox versions prior to 152 and Firefox ESR prior to 140.12. The CVSS Scope:Changed metric confirms the flaw crosses the sandbox boundary, while impact is constrained to low confidentiality disclosure with no integrity or availability consequence. No public exploit code exists and SSVC confirms no known exploitation; EPSS at 0.18% (8th percentile) reinforces this is a lower-priority real-world threat despite the sandbox-crossing nature of the bug.
SPIP versions 4.4.10 through 4.4.12 contain a privilege escalation vulnerability that allows authenticated users with limited permissions to assign administrator privileges to themselves or other accounts through improper handling of the STATUT field during author data structure editing. An attacker with login credentials and user interaction can exploit this to gain full administrative control, leading to complete compromise of the CMS instance. The vulnerability was patched in version 4.4.13.
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Authorization bypass in OpenStack Aodh's alarm list API allows any authenticated user with the reader role to enumerate alarms across all projects by exploiting a logic flaw where passing `all_projects=false` removes the project-scoping key entirely rather than restricting scope - exposing trust webhook URLs, Heat signal endpoints, project IDs, and user IDs from foreign projects. The leaked webhook URLs directly enable a second-stage attack against OpenStack Watcher, whose webhook trigger endpoint has enforced no authorization since the Ussuri release (Watcher 4.0.0), permitting any authenticated user who obtains a webhook URL to start EVENT audits and execute associated action plans against arbitrary projects. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.4 reflects the chained confidentiality-then-cross-system-integrity impact of these two related flaws.
Firefox's Process Sandboxing component allows information disclosure and partial sandbox escape when a user visits a specially crafted webpage, affecting all Firefox versions prior to 152 and Firefox ESR prior to 140.12. The CVSS Scope:Changed metric confirms the flaw crosses the sandbox boundary, while impact is constrained to low confidentiality disclosure with no integrity or availability consequence. No public exploit code exists and SSVC confirms no known exploitation; EPSS at 0.18% (8th percentile) reinforces this is a lower-priority real-world threat despite the sandbox-crossing nature of the bug.
SPIP versions 4.4.10 through 4.4.12 contain a privilege escalation vulnerability that allows authenticated users with limited permissions to assign administrator privileges to themselves or other accounts through improper handling of the STATUT field during author data structure editing. An attacker with login credentials and user interaction can exploit this to gain full administrative control, leading to complete compromise of the CMS instance. The vulnerability was patched in version 4.4.13.
A vulnerability has been identified in JT Utilities (All versions < V13.0.2.0). Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.