Filippo Decortes

**Name of the Vulnerable Software and Affected Versions** Booking Calendar versions prior to 10.14.11 **Description** The Booking Calendar plugin for WordPress is susceptible to sensitive information exposure via the `WPBC FLEXTIMELINE NAV` AJAX action. This occurs because nonce verification is conditionally disabled by default when the `booking is nonce at front end` option is set to `'Off'`. When the `booking is show popover in timeline front end` option is enabled, unauthenticated attackers can extract sensitive booking data, including customer names, email addresses, phone numbers, and booking details. **Recommendations** Update Booking Calendar to version 10.14.11 or later.

**Name of the Vulnerable Software and Affected Versions** Webmin versions prior to 2.600 **Description** The application does not properly handle arguments within the `cachemgr.cgi` script when the Squid module and its Cache Manager feature are enabled. This issue arises if an unauthorized user gains access to Webmin and possesses specific Cache Manager permissions, specifically the "cms" security option. The problem occurs when arguments are not correctly quoted, potentially leading to unintended consequences. **Recommendations** Update to Webmin version 2.600 or later.

**Name of the Vulnerable Software and Affected Versions** AliasVault API versions 0.23.0 and lower **Description** A server-side request forgery (SSRF) vulnerability exists in the favicon extraction feature. The extractor fetches a user-supplied URL, parses the returned HTML, and follows `<link rel="icon" href="…"`. While the initial URL is validated to allow only HTTP/HTTPS with default ports, the extractor automatically follows redirects and does not block requests to loopback or internal IP ranges. An authenticated, low-privileged user can exploit this behavior to coerce the backend into making HTTP(S) requests to arbitrary internal hosts and non-default ports. If the target host serves a favicon or any other valid image, the response is returned to the attacker in Base64 form. Timing and error behavior can be abused to map internal services. This vulnerability only affects self-hosted AliasVault instances reachable from the public internet with public user registration enabled. **Recommendations** Upgrade to AliasVault version 0.23.1 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** The issue allows unauthenticated users to perform stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of some parameters when outputting them back in a page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.