Aydinnyunus

**Name of the Vulnerable Software and Affected Versions** html2pdf.js versions prior to 0.14.0 **Description** html2pdf.js converts webpages or elements into printable PDFs client-side. When provided with a text source instead of an element, versions prior to 0.14.0 do not sufficiently sanitize the text before attaching it to the Document Object Model (DOM). This allows malicious scripts to execute in the client browser, potentially compromising the confidentiality, integrity, and availability of the page’s data. An example attack vector involves using a malicious HTML string containing an `img` tag with an `onerror` event handler, such as `<img src=x onerror="alert(document.cookie)">`, to execute JavaScript code. **Recommendations** Versions prior to 0.14.0 should be updated to version 0.14.0, which includes text source sanitization using DOMPurify. As a workaround, users of earlier versions must safely sanitize any text before using it as a source in html2pdf.js.

Name of the Vulnerable Software and Affected Versions: XPixelGroup BasicSR versions 1.4.2 and earlier Description: The issue might locally allow code execution in specific situations where `scontrol show hostname` is executed with a crafted `SLURM NODELIST` environment variable. Recommendations: For XPixelGroup BasicSR versions 1.4.2 and earlier, consider restricting the execution of `scontrol show hostname` to prevent potential code execution in the presence of a crafted `SLURM NODELIST` environment variable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ip-utils versions prior to 2.4.0 **Description** The issue concerns the ip-utils package, which might allow Server-Side Request Forgery (SSRF) due to improper categorization of certain IP addresses as globally routable. This occurs because some IP addresses, such as `0x7f.1`, are incorrectly marked as globally routable through a falsy `isPrivate` return value. **Recommendations** For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework (MobSF) versions prior to 3.9.7 Description: The issue concerns a server-side request forgery vulnerability. It occurs when the `requests.get()` request in the ` check url` method is set to `allow redirects=True`, allowing a redirect when a request to `.well-known/assetlinks.json` returns a 302 redirect. This vulnerability is a bypass of a previous fix. Recommendations: For versions prior to 3.9.7, update to version 3.9.7 to resolve the issue. As a temporary workaround, consider setting `allow redirects=False` in the `requests.get()` request of the ` check url` method to prevent server-side request forgery. Restrict access to the ` check url` method to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mobile Security Framework (MobSF) versions 3.9.5 Beta and prior **Description** The issue arises from the lack of input validation when extracting hostnames in `android:host`, allowing requests to be sent to local hostnames. This can lead to server-side request forgery, enabling an attacker to cause the server to connect to internal-only services within an organization's infrastructure. The vulnerability is exploited through the `/api/v1/login` endpoint is not mentioned, however, the `android:host` parameter is used to send requests to local hostnames. **Recommendations** For Mobile Security Framework (MobSF) versions 3.9.5 Beta and prior, apply the hotfix from commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 to resolve the issue. As a temporary workaround, consider restricting access to the `android:host` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** BlackCat CMS version 1.1.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `name` in a new group to "backend/groups/index.php" API endpoint. This enables attackers to perform cross-site scripting (XSS) attacks. **Recommendations** For BlackCat CMS version 1.1.2, as a temporary workaround, consider restricting access to the "backend/groups/index.php" endpoint to minimize the risk of exploitation. Avoid using the `name` variable in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.