Alejandro Parodi

**Name of the Vulnerable Software and Affected Versions** Moodle versions 3.1 to 3.1.15 Moodle versions prior to 3.1 **Description** A flaw in the mybackpack functionality allowed setting the URL of badges to any value, instead of restricting it to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind Server-Side Request Forgery (SSRF) via requests made by the page. **Recommendations** For Moodle versions 3.1 to 3.1.15, consider restricting the `mybackpack` functionality to only allow the Mozilla Open Badges backpack URL until a fix is available. For Moodle versions prior to 3.1, consider updating to a supported version or restricting the `mybackpack` functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ISC BIND 9 versions 9.9.9 before 9.9.9-P3 ISC BIND 9 versions 9.10.x before 9.10.4-P3 ISC BIND 9 versions 9.11.x before 9.11.0rc3 **Description** The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon exit, by sending a crafted query. This can also be triggered by sending an overly long request when lwresd or the named lwres option is enabled, causing the daemon to crash. **Recommendations** For ISC BIND 9 versions 9.9.9 before 9.9.9-P3, update to version 9.9.9-P3 or later. For ISC BIND 9 versions 9.10.x before 9.10.4-P3, update to version 9.10.4-P3 or later. For ISC BIND 9 versions 9.11.x before 9.11.0rc3, update to version 9.11.0rc3 or later. As a temporary workaround, consider disabling the lwresd option or the named lwres option to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Schneider Electric Modbus Serial Driver versions 1.10 through 3.2 **Description** The issue is caused by multiple stack-based buffer overflows in ModbusDrv.exe, allowing remote attackers to execute arbitrary code via a large buffer-size value in a `Modbus Application Header`. This can be exploited by sending a specially crafted request with a large buffer-size value, potentially leading to code execution. **Recommendations** For versions 1.10 through 3.2, update to a version that fixes the buffer overflow issue in ModbusDrv.exe to prevent remote code execution. As a temporary workaround, consider restricting access to the Modbus Application Header to minimize the risk of exploitation.