Dizconnectz

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.1-beta **Description** An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks. **Recommendations** Update Hi.Events to version 1.11.1-beta.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.40.0 **Description** A SQL injection issue exists in the Oracle datasource connector during the post-write row lookup process. The system fails to properly escape table names used in identifiers. An attacker with write permissions on a table containing a double-quote in its name can inject SQL commands. These commands execute with the privileges of the datasource database user, allowing the attacker to read or modify arbitrary data. **Recommendations** Update to version 3.40.0 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The quick setup view, used after the initial creation of an event, fails to properly verify if a user has the necessary permissions to modify the configuration of a specific event. This authorization flaw allows an attacker to send a well-timed request to perform unauthorized actions on events they do not have access to, such as creating products and quotas, configuring bank transfers, or connecting a Stripe account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.