Jaime Ramírez

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.2.0 **Description** Authenticated attackers can execute arbitrary commands on the server host outside of containers. This occurs because the software fails to properly escape environment variable key names when executing Docker commands over SSH on managed servers, allowing the injection of shell metacharacters into these keys. **Recommendations** Update to version 4.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Snipe-IT versions prior to 8.7.0 **Description** An issue exists where the bulk asset restore endpoint is restricted by the `assets.edit` permission rather than the `assets.delete` permission. This allows users who possess edit rights but lack delete rights to restore soft-deleted assets. An attacker can send asset identifiers to the bulk restore endpoint to reverse deletions performed by an administrator, thereby bypassing the intended permission separation. **Recommendations** Update to version 8.7.0 or later.

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.1-beta **Description** An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks. **Recommendations** Update Hi.Events to version 1.11.1-beta.

**Name of the Vulnerable Software and Affected Versions** Baserow versions prior to 2.3.0 **Description** Baserow fails to HTML encode a user's display name when interpolating it into rich-text mention markup. The endpoint 'PATCH /api/user/account/' stores the `first name` value verbatim. Subsequently, the mention renderer in `web-frontend/modules/core/editor/mention.js` uses a template literal to place this name into a `data-label` attribute and the element body without escaping. A name containing a double quote can close the attribute and the opening tag, allowing subsequent markup to be injected into the element content. Because rich-text field components render this result through `v-html`, any rich-text cell mentioning the account executes the stored script for every workspace member who views the table without requiring a click. Any workspace member, regardless of permission level, can set their name to deliver the payload, which persists until the name is changed or the mentioning row is removed. **Recommendations** Update to version 2.3.0.

**Name of the Vulnerable Software and Affected Versions** AzuraCast (affected versions not specified) **Description** An improper permission check in the profile editing process allows users with only profile permissions to modify Liquidsoap custom configuration fields. The endpoint 'PUT /api/station/{station id}/profile/edit' deserializes data using a general group that includes the `backend config` property, bypassing the stricter permissions required by the dedicated configuration endpoint. This allows the modification of variables including `custom config top`, `custom config`, `custom config pre playlists`, `custom config pre live`, `custom config pre fade`, and `custom config bottom`. These values are written directly into the Liquidsoap .liq script, where the `process.run()` and `process.exec()` built-in functions can be used to execute operating system commands upon a backend restart. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Akaunting version 3.1.21 **Description** An authenticated improper authorization issue exists in the common BulkActions dispatcher. Improper authorization occurs when an application fails to sufficiently verify if a user has the necessary permissions to perform a specific action. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions prior to 2.3.2 **Description** Cross-site Scripting occurs in the Markdown renderer when authenticated users provide a Markdown link containing a double quote in the URL. This character closes the anchor's href attribute because the sanitization process fails to escape quotes, allowing the execution of arbitrary JavaScript within the application origin. **Recommendations** Update maalfer Pentestify to version 2.3.2 or later.