Yoojoon2

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The web GUI allows the specification of custom column types for tables. When the URL type is used, the system forms a clickable link from the cell value. Because the code does not restrict the allowed URL schemes, an attacker can use a JavaScript scheme to execute a Cross-Site Scripting (XSS) attack, which occurs when malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea versions 1.26.4 and earlier **Description** The `restore-repo` CLI command fails to properly validate the `Head.CloneURL` field when parsing `pull request.yml` from a repository dump. The safety check function `CheckAndEnsureSafePR()` is called with an empty `commonCloneBaseURL` variable, which effectively disables the validation. This allows a malicious dump file to force the Gitea server to execute a `git fetch` command against an attacker-specified URL. This can lead to Server-Side Request Forgery (SSRF) against internal services or cloud metadata endpoints, or the disclosure of local git repositories using the `file://` protocol. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.