Tikket1

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.1-beta **Description** An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks. **Recommendations** Update Hi.Events to version 1.11.1-beta.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** Three code paths bypass the existing Server-Side Request Forgery (SSRF) protections by using raw `http.Get()` instead of the validated `hostmatcher.NewDialContext()` dialer. This allows an attacker to make requests to internal services, scan internal networks (such as `127.0.0.1`, `10.x`, `172.16-31.x`, and `192.168.x`), and steal cloud metadata from endpoints like `169.254.169.254` (e.g., AWS IMDSv1 credentials or GCP tokens). Additionally, the use of the `file://` scheme in the `Open()` function enables local file read, potentially exposing sensitive files such as `/etc/gitea/app.ini` which may contain database credentials and JWT signing secrets. The issue affects the following components: - The `Open()` function in `modules/uri/uri.go`. - Release asset and PR patch downloads in `services/migrations/gitea uploader.go` and `services/migrations/dump.go`. - The `oauth2UpdateAvatarIfNeed()` function in `routers/web/auth/oauth.go`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.6.0 through 0.7.2 **Description** A SQL injection issue exists in the `Massmailer` module filter functionality. An authenticated administrator can provide crafted filter values during the update of a mass email message, which allows untrusted input to be interpolated directly into the SQL recipient selection query. **Recommendations** Update to version 0.8.0. Restrict administrator access to trusted users only. Disable the `Massmailer` module if it is not required. Audit existing records in the `mod massmailer` table for suspicious filter values. Review administrator activity related to `Massmailer` message updates.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** The Guest API 'invoice/update' endpoint lacks an authorization check. This allows an unauthenticated user who possesses an invoice hash to modify the payment gateway of an unpaid invoice by changing the `gateway id` variable to any payment gateway already configured in the system. Invoice hashes may be exposed through email links, referrer headers, or shared URLs. The impact is limited by the `invoice accessible from hash` system setting and the requirement that the gateway must be pre-installed by an administrator. **Recommendations** Update to version 0.8.0.

**Name of the Vulnerable Software and Affected Versions** Coolify versions prior to 4.0.0-beta.471 **Description** Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Server and project lookups are not scoped to the current team, which allows any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly. **Recommendations** Update to version 4.0.0-beta.471.

Name of the Vulnerable Software and Affected Versions Hi.Events versions 0.8.0-beta.1 through 1.7.1-beta Description Hi.Events is an open-source event management and ticket selling platform. Multiple repository classes pass the user-supplied `sort by` query parameter directly to Eloquent's `orderBy()` without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries. Recommendations Update to version 1.7.1-beta or later.