Online Brute Force of Bitwarden Send Email-OTP Access Gates
Bitwarden Sends can be gated so that only a recipient of an emailed 6-digit one-time code may open the shared link. On self-hosted installations that code is the only barrier between a link holder and the Send's plaintext content — and the redemption path applies no attempt counter, no per-attempt delay, and, because the generic IP rate limiter is only registered for cloud deployments, no rate limiting at all. The 5-minute code window can additionally be renewed on demand by the attacker. A holder of a leaked link can therefore exhaust the 1,000,000-code keyspace online in minutes and decrypt the Send with the key carried in the link itself.
Joomla: InputFilter HTML5 entity mismatch bypasses JavaScript URI filtering
InputFilter decodes HTML4 entities before checking dangerous URI schemes, while browsers recognize HTML5 entities. A scheme split with an HTML5-only whitespace entity can survive filtering and regain JavaScript URL semantics in a browser.
Joomla: Cache purge permits arbitrary directory deletion
Cache purge accepts traversal segments in cache-group names and checks containment before resolving them, enabling deletion outside the cache directory.
Joomla: Stored XSS in media custom-field output
Media custom-field values can reach HTML attributes without context-appropriate escaping, allowing a user with field-edit permission to store JavaScript that executes when another visitor renders the affected content.
Joomla: Newsfeeds protocol handling enables SSRF and conditional session forgery
Newsfeeds accepts unsafe URL protocols and passes stored feed locations to server-side fetching. A user with Newsfeeds permissions can cause requests from the server; the revised report demonstrates a conditional Manager-to-Super-User chain on Redis-backed installations.
MyBB: ACP View Manager titles permit stored cross-site scripting
A delegated administrator with user-management permission can store a View Manager title that is rendered without HTML encoding to other administrators.
MyBB: Reply quoting uses the carrier forum’s moderator permissions
A moderator can quote hidden posts from another viewable forum because deleted/unapproved visibility is authorized against the reply thread’s forum instead of each quoted post’s forum.
MyBB: New Reply discloses thread-restricted post content
The reply form can reveal subjects and full post text from forums where the requester lacks canviewthreads.
MyBB: All Reports view can disclose reports outside moderator scope
The All Reports view can become board-wide when the moderator’s forum restriction is empty, exposing reported content outside their assignment.
MyBB: Moderation queue actions can lose forum restrictions
Moderation queue actions can approve or delete content outside a moderator’s forum scope when a permission-derived SQL restriction is empty.
MyBB: Warning view and revocation bypass moderator user boundaries
Warning viewing and revocation omit the user-management authorization checks applied when issuing warnings, allowing a moderator to act on users outside their management scope.
MyBB: Search exposes content from thread-restricted forums
Search results can disclose subjects and post snippets from forums where canviewthreads denies normal thread access.
MyBB: Who’s Online reveals restricted thread subjects
Who’s Online reveals thread subjects and links from forums where the viewer can see the forum but is denied permission to view its threads.
MyBB: Post split and move operations omit destination authorization
A moderator can relocate posts into a forum they are not authorized to moderate because split and move-posts handlers validate only the source forum.
MyBB: Image thumbnail processing permits memory exhaustion
Image processing raises PHP’s memory limit based on untrusted image dimensions instead of rejecting excessive work. Avatar size limits are checked after image decoding.
MyBB: Delayed moderation authorizes the wrong forum
A moderator of one forum can schedule moderation actions against threads in another forum because authorization uses a request-supplied forum ID instead of each target thread’s real forum.
MyBB: Multiquote exposes draft, deleted and other users’ restricted posts
The multiquote endpoint can return draft and soft-deleted post content, and posts belonging to other users in own-thread-only forums, because its visibility checks do not consistently reject unauthorized rows.
MyBB: Unauthenticated access to draft-post attachments
An unauthenticated visitor can download attachments belonging to another user’s draft post. MyBB 1.8.40 skips the normal permission checks for draft posts without checking ownership. The vendor confirmed the issue and fixed it in MyBB 1.8.41 (GHSA-gr56-j98m-p582).
Subscriber-to-author comprehensive WordPress data breach through legacy handlers
The supplied chain combines four low-privilege disclosure paths: approved-comment PII to a Subscriber, userlogin enumeration to a Contributor, unpublished-post title enumeration to an Author, and private attachment/file disclosure to an Author. Together they can expose private content and identity data; self-registration and each capability or configuration are prerequisites.
Contributor-to-internal-network reflected SSRF proxy through URL details
A Contributor can use the URL-details endpoint as a reflected server-side HTTP proxy. The supplied chain analysis combines the reflected metadata fields with the shared special-use IP validator gap and DNS-resolution TOCTOU. Reading internal services is demonstrated by the component report; broader network mapping and cloud metadata access depend on reachable services and configuration.