Baixin513

**Name of the Vulnerable Software and Affected Versions** MaxKB versions prior to 2.9.0 **Description** The webhook trigger endpoint '/api/trigger/v1/webhook/{trigger id}' is accessible without authentication. This occurs because the `WebhookAuth` class unconditionally returns `(None, {})`, which the Django REST Framework interprets as successful authentication. Due to optional per-trigger token verification and a lack of backend enforcement for token requirements, an unauthenticated attacker with a valid `trigger id` can invoke webhook triggers to execute bound tasks. **Recommendations** Update to version 2.9.0.

**Name of the Vulnerable Software and Affected Versions** cloudexplorer-lite versions prior to 1.2.0 **Description** The issue is related to weak passwords that can be easily guessed, making them an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. **Recommendations** For versions prior to 1.2.0, upgrade to version 1.2.0 to fix the issue. At the moment, there are no known workarounds for this vulnerability.