Evan Ricafort

**Name of the Vulnerable Software and Affected Versions** Rapid7 Corporate Website versions prior to May 2nd 2025 **Description** The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to a malicious site due to misconfigured headers. **Recommendations** For versions prior to May 2nd 2025, update to a version released on or after May 2nd 2025 to resolve the issue. As a temporary workaround, consider restricting access to untrusted sites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 16 macOS versions prior to 13 **Description** The issue allows an app to bypass Privacy preferences, which was addressed with improved data protection. **Recommendations** For iOS versions prior to 16, update to iOS 16 to resolve the issue. For macOS versions prior to 13, update to macOS Ventura 13 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.2.4 **Description** The issue is related to a Server Side Request Forgery (SSRF) vulnerability. This occurs because Windows paths are mishandled during certain validation of relative URLs. **Recommendations** For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.2.4 **Description** The issue is related to a stored XSS (cross-site scripting) vulnerability via the Customizer. This vulnerability can be exploited by a remote attacker to impact data integrity. **Recommendations** For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Customizer until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 5.2.4 **Description** The issue is related to a type confusion error during referer validation on admin pages, which could lead to a CSRF attack. This might allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to admin pages to minimize the risk of exploitation.