Louis Sanchez

**Name of the Vulnerable Software and Affected Versions** HyperDX versions prior to 2.31.0 **Description** Authenticated team members can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended destination. By providing a caller-controlled `host` parameter to the ClickHouse proxy test endpoint, an attacker can direct the server to arbitrary internal destinations due to a lack of URL validation or allowlist enforcement. This allows the disclosure of internal service response bodies through reflected error responses, enabling unauthorized access to internal APIs, container services, and cloud provider metadata endpoints. **Recommendations** Update to version 2.31.0 or later. Restrict network access to minimize the risk of internal probing.

**Name of the Vulnerable Software and Affected Versions** Leantime (affected versions not specified) **Description** The `Users::getUser()` function within the JSON-RPC API does not implement sufficient authorization checks. This allows authenticated users to retrieve complete user credential records by providing arbitrary user IDs. The exposed data includes password hashes, TOTP (Time-based One-Time Password) secrets, and session tokens, which can be used for account enumeration, offline password cracking, bypassing two-factor authentication, and session hijacking. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.