Fewword

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.1-beta **Description** An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks. **Recommendations** Update Hi.Events to version 1.11.1-beta.

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 25.5.0 Description: The issue is a Stored Cross-Site Scripting (XSS) vulnerability that affects the `group name` parameter of the "http://localhost/poller/groups" form. This allows attackers to inject malicious scripts into web pages viewed by other users. Recommendations: For versions prior to 25.5.0, update to version 25.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "http://localhost/poller/groups" form until the update is applied. Avoid using the `group name` parameter in the affected form until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kanboard versions 1.2.26 through 1.2.44 **Description** The issue is a Stored Cross-Site Scripting (XSS) vulnerability in the `name` parameter of the "http://localhost/?controller=ProjectCreationController&action=create" form. This allows attackers to inject malicious scripts into web pages viewed by other users. The default content security policy (CSP) blocks the JavaScript attack, but it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection due to the `unsafe-inline` directive in the default CSP. **Recommendations** For versions 1.2.26 through 1.2.44, update to version 1.2.45 or later to resolve the issue. As a temporary workaround, consider restricting access to the `http://localhost/?controller=ProjectCreationController&action=create` form until the update is applied. Additionally, review and adjust the content security policy (CSP) to prevent CSS injection by removing the `unsafe-inline` directive if possible.