Abdivasiyev Sunnatillo

**Name of the Vulnerable Software and Affected Versions** MLflow (affected versions not specified) **Description** MLflow AI Gateway fails to validate the `auth config.api base` value during the creation of a gateway secret in the ` create gateway secret()` function. This value is stored without verification of the scheme, host, or IP range. Subsequently, the `raw proxy` endpoint issues HTTP requests to the stored `api base` combined with a caller-supplied path and returns the full response body. Because the internal SSRF guard ` validate webhook url()` is not utilized in this code path, the system is susceptible to Server-Side Request Forgery (SSRF). Furthermore, the CreateGatewaySecret action lacks specific permission validation, allowing any authenticated user, including those with read-only access, to create secrets pointing to internal addresses. This could lead to the exposure of cloud-instance IAM credentials via metadata services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions pymetasploit3 versions through 1.0.6 Description A command injection issue exists in the `console.run module with output()` function of pymetasploit3. Attackers can inject newline characters into module options, such as the `RHOSTS` parameter, disrupting command parsing and potentially enabling arbitrary command execution and manipulation of Metasploit sessions. Recommendations Update pymetasploit3 to a version later than 1.0.6.