Dyingman1

**Name of the Vulnerable Software and Affected Versions** CC: Tweaked versions prior to 1.120.0 **Description** An issue exists in the Server-Side Request Forgery (SSRF) protection within the `AddressPredicate.java` file. While the system blocks the RFC 6052 64:ff9b::/96 NAT64 prefix, it fails to block the RFC 8215 64:ff9b:1::/48 local-use prefix. On dual-stack servers utilizing RFC 8215 NAT64, an unauthenticated user capable of executing Lua code can utilize the `http.request` or `http.websocket` functions with an address under 64:ff9b:1::/48 to access loopback, RFC 1918, cloud metadata, or internal API endpoints. This occurs because the `PrivatePattern.matches()` function does not correctly classify the mapped IPv6 address as private. **Recommendations** Update to version 1.120.0.

**Name of the Vulnerable Software and Affected Versions** n8n-nodes-sqlite3 versions prior to 1.0.0 **Description** The `nodes/SqliteNode/v1/SqliteV1.node.ts` file exposes the `db path` parameter, which allows data expressions from upstream workflow input. If a workflow author maps untrusted input to this parameter, a remote attacker can control which SQLite file the process opens. This enables path traversal, allowing the attacker to read, create, or overwrite files accessible to the n8n process. This issue is particularly risky in multi-tenant or user-facing deployments where untrusted users can influence workflow configuration. **Recommendations** Update n8n-nodes-sqlite3 to version 1.0.0.

**Name of the Vulnerable Software and Affected Versions** Apache InLong versions 2.0.0 through 2.3.x **Description** A relative path traversal issue allows for arbitrary file read operations from the Agent host filesystem. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** Upgrade to version 2.4.0.

**Name of the Vulnerable Software and Affected Versions** LearnPress versions prior to 4.3.7 **Description** An information disclosure issue exists where the `edit` context on a REST endpoint is not properly restricted by the `edit users` capability. This allows unauthenticated visitors to retrieve sensitive user data, including roles, full capabilities map, extra capabilities, locale, and registration date, by sending a crafted request. **Recommendations** Update LearnPress to version 4.3.7 or later.

**Name of the Vulnerable Software and Affected Versions** handlebars versions prior to 4.5.2 **Description** Applications that pass user-controlled input to the `Handlebars.compile()` function using a FileTemplateLoader or ClassPathTemplateLoader are susceptible to arbitrary file read. This occurs when web applications utilize template names sourced from URL path parameters, request parameters, or other user-controlled inputs, allowing for path traversal. **Recommendations** Update to version 4.5.2. Validate that the template name is not derived from user input or implement a check to ensure the file path starts with the expected canonical path to prevent path traversal.

**Name of the Vulnerable Software and Affected Versions** Jenkins Multijob Plugin versions prior to 662.vd2e0001f6b b d **Description** A cross-site request forgery (CSRF) flaw allows attackers to resume failed Multijob builds. CSRF is a type of attack that tricks a victim into submitting a malicious request to a web application where they are currently authenticated. **Recommendations** Update the Jenkins Multijob Plugin to a version later than 662.vd2e0001f6b b d.

**Name of the Vulnerable Software and Affected Versions** Jenkins Bitbucket OAuth Plugin versions prior to 0.18 **Description** The plugin fails to restrict the redirect URL after the login process, which enables attackers to conduct phishing attacks via open redirection. **Recommendations** Update to a version later than 0.17.

**Name of the Vulnerable Software and Affected Versions** Jenkins GitHub Integration Plugin versions prior to 0.7.4 **Description** A cross-site request forgery (CSRF) flaw allows attackers to trigger a build for a pull request. CSRF is a type of attack that tricks a victim into submitting a malicious request to a web application where they are currently authenticated. **Recommendations** Update to a version later than 0.7.3.

**Name of the Vulnerable Software and Affected Versions** Jenkins Job Import Plugin versions prior to 143.v044a 2e819b 27 **Description** A missing permission check in an HTTP endpoint allows users with Overall/Read permissions to enumerate the IDs of credentials stored within Jenkins. **Recommendations** Update the plugin to a version later than 143.v044a 2e819b 27.

**Name of the Vulnerable Software and Affected Versions** Jenkins buildgraph-view Plugin versions prior to 1.9 **Description** The buildgraph-view Plugin fails to escape the build URL, leading to a stored cross-site scripting (XSS) issue. This can be exploited by attackers who have permissions to configure jobs or views. Cross-site scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. **Recommendations** Update to a version later than 1.8.

**Name of the Vulnerable Software and Affected Versions** Jenkins Microsoft Entra ID (previously Azure AD) Plugin versions prior to 666.v6060de32f87d **Description** The plugin does not restrict the redirect URL after login, which allows attackers to perform phishing attacks. **Recommendations** Update the plugin to a version later than 666.v6060de32f87d.