Garrett

**Name of the Vulnerable Software and Affected Versions** Coder versions prior to 2.34.2 Coder versions prior to 2.33.8 Coder versions prior to 2.32.7 Coder versions prior to 2.29.17 **Description** The tailnet coordinator fails to validate that an agent's `AllowedIPs` derive from its authenticated UUID, whereas it does perform this check for `Addresses`. Consequently, the coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers, which are then installed into the WireGuard peer configuration. A malicious authenticated user with a modified agent binary can advertise arbitrary `AllowedIPs` prefixes, including those of another agent. This allows the attacker to intercept web terminal and workspace app traffic and serve spoofed content by claiming a victim's prefix. **Recommendations** Update to version 2.34.2 or later. Update to version 2.33.8 or later. Update to version 2.32.7 or later. Update to version 2.29.17 or later. Monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Centralized Covid Vaccination Records System version 1.0 **Description** A critical issue has been found in the GET Parameter Handler component of the file /vaccinated/admin/maintenance/manage location.php. The manipulation of the `id` argument leads to sql injection. The attack can be initiated remotely. **Recommendations** For version 1.0, consider disabling the `manage location.php` file or restricting access to the `id` argument in the affected API endpoint until a patch is available. Avoid using the `id` argument in the `/vaccinated/admin/maintenance/manage location.php` endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.