Google Maps
Monthly
The alexpechkarev/google-maps Laravel package through version 12.16 ships with TLS certificate verification turned off by default: the bundled config file sets ssl_verify_peer to FALSE, which is handed straight to CURLOPT_SSL_VERIFYPEER, so any Laravel application using the package without overriding the config will accept any certificate presented by the Google Maps web-service endpoint. An attacker who occupies an on-path position between the application server and Google (hostile Wi-Fi, rogue proxy, DNS or ARP spoofing, or a compromised upstream hop) can therefore terminate a fake TLS session, read the Google Maps API key carried in the request query string, and modify geocoding or map responses returned to the application. Exploitation requires no authentication and no user interaction, but the on-path vantage point is the limiting factor; no public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (not in CISA KEV).
Vulnerability in Drupal Google Maps: Store Locator.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The alexpechkarev/google-maps Laravel package through version 12.16 ships with TLS certificate verification turned off by default: the bundled config file sets ssl_verify_peer to FALSE, which is handed straight to CURLOPT_SSL_VERIFYPEER, so any Laravel application using the package without overriding the config will accept any certificate presented by the Google Maps web-service endpoint. An attacker who occupies an on-path position between the application server and Google (hostile Wi-Fi, rogue proxy, DNS or ARP spoofing, or a compromised upstream hop) can therefore terminate a fake TLS session, read the Google Maps API key carried in the request query string, and modify geocoding or map responses returned to the application. Exploitation requires no authentication and no user interaction, but the on-path vantage point is the limiting factor; no public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (not in CISA KEV).
Vulnerability in Drupal Google Maps: Store Locator.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.