Mike197312

**Name of the Vulnerable Software and Affected Versions** Poweradmin versions prior to 4.2.4 Poweradmin versions prior to 4.3.3 **Description** Poweradmin is a web-based DNS administration tool for PowerDNS server. The software uses the attacker-controlled `HTTP HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without validation. An unauthenticated attacker can poison the `redirect uri` sent to the Identity Provider, causing the Identity Provider to redirect the victim's authorization code to an attacker-controlled server, which can lead to full account takeover without requiring credentials. **Recommendations** Update to version 4.2.4 Update to version 4.3.3

**Name of the Vulnerable Software and Affected Versions** Filament versions 3.0.0 through 3.3.52 **Description** A disabled `RichEditor` field renders its raw state without sanitizing HTML. If the data stored in the field's state was not previously sanitized when the form state was filled, an attacker can inject malicious HTML or JavaScript. This leads to Cross-Site Scripting (XSS), which is a technique where malicious scripts are injected into trusted websites, executing in the browser of users who view the form. **Recommendations** Update to version 3.3.53.