Elure

**Name of the Vulnerable Software and Affected Versions** Simple Machines Forum versions prior to 2.1.8 Simple Machines Forum versions prior to 3.0 Alpha 5 **Description** An authorization bypass exists in the `Sources/Actions/AttachmentApprove.php` file due to a single-character operator error that causes permission checks to always pass. This allows an authenticated low-privileged user to approve, reject, or delete any pending attachments on any board without the `approve posts` permission. Additionally, users can bypass moderation queues for their own uploads and enumerate or delete pending attachments belonging to other users. **Recommendations** Update Simple Machines Forum 2.1 to version 2.1.8 or later. Update Simple Machines Forum 3.0 to version 3.0 Alpha 5 or later.

Name of the Vulnerable Software and Affected Versions GeoNode versions 4.0 through 4.4.5 and 5.0 through 5.0.2 Description GeoNode versions 4.0 through 4.4.5 and 5.0 through 5.0.2 contain a server-side request forgery issue. Authenticated users with document upload permissions can trigger arbitrary outbound HTTP requests by providing a malicious URL via the `doc url` parameter during document upload. Attackers can supply URLs pointing to internal network targets, loopback addresses, RFC1918 addresses, or cloud metadata services, causing the server to make requests to internal resources without SSRF mitigations such as private IP filtering or redirect validation. Recommendations Update to GeoNode version 4.4.5 or later. Update to GeoNode version 5.0.2 or later.

Name of the Vulnerable Software and Affected Versions GeoNode versions 4.0 through 4.4.5 and 5.0 through 5.0.2 Description GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 are affected by a server-side request forgery issue in the service registration endpoint. Authenticated attackers can trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Insufficient URL validation in the WMS service handler, without private IP filtering or allowlist enforcement, allows attackers to probe internal network targets, including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services. Recommendations Update GeoNode to version 4.4.5 or later. Update GeoNode to version 5.0.2 or later.