Vulnerability Lookup
Monthly
Server-side request forgery in Vulnerability-Lookup's remote-instance synchronization feature enables an authenticated administrator holding the admin:access permission to pivot HTTP requests through the application server's network context. By registering a remote instance whose address resolves to a loopback, private, link-local, or cloud metadata endpoint - or by using a public URL that redirects to such a destination - the attacker causes the background sync worker to issue HTTP GET requests from the server's own network position, potentially exposing internal services or cloud instance metadata credentials. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a patch is available as an upstream commit from CIRCL.
Token replay in Vulnerability-Lookup's account activation and password-recovery mechanism allows an attacker who captures a valid one-time link to repeatedly reset the victim's password throughout the entire TOKEN_VALIDITY_PERIOD, even after the legitimate user has already consumed that token. Because the application never records whether a token has been used and does not bind tokens to a specific workflow, a single intercepted link grants persistent account-takeover capability without requiring any knowledge of the victim's current credentials. Reported by CIRCL, no public exploit code or CISA KEV listing exists at time of analysis; an upstream patch is available via a GitHub commit.
Inconsistent authorization enforcement in Vulnerability-Lookup's SSE streaming interface allows self-registered but unconfirmed or inactive accounts to subscribe to Pub/Sub event streams, accessing pre-moderation data that the REST API correctly restricts. The platform's self-registration flow issues an API key before account confirmation is complete, and the token_required decorator on /pubsub/subscribe/<topic> validated only that the key matched a known user - not that the account was active or confirmed. No public exploit has been identified at time of analysis, and a vendor-released patch correcting the authorization gap is confirmed available via upstream commit.
Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holding the vulnerability:create or vulnerability:modify permission to persist arbitrary JavaScript in public vulnerability record pages by submitting crafted reference tags via the CNA API. The flaw stems from markupsafe.Markup being applied to attacker-controlled tag values before HTML escaping, effectively suppressing Jinja's automatic sanitization and causing the payload to execute in any visitor's browser - including unauthenticated users - upon page load. No public exploit has been identified at time of analysis beyond the functional XSS payload embedded in the fix's test suite; a patch is available as upstream commit d29901655c50cf3c25737d9ea86180268df51b57.
SSRF guard bypass in Vulnerability Lookup's webhook notification subsystem allows a network attacker to register a webhook URL whose hostname resolves to an IPv6 transition address (NAT64, 6to4, Teredo, or IPv4-mapped), causing the application to issue server-side requests to private, loopback, or cloud metadata endpoints that should be blocked. The flaw stems from relying solely on Python's `is_global` property, which correctly returns True for IANA-routable transition prefixes but fails to inspect the private IPv4 address embedded within them. Exposure is strictly limited to organizations running the unreleased HEAD version of the application; no tagged release is affected, no public exploit has been identified, and the upstream fix has already landed.
Server-side request forgery in Vulnerability-Lookup's remote-instance synchronization feature enables an authenticated administrator holding the admin:access permission to pivot HTTP requests through the application server's network context. By registering a remote instance whose address resolves to a loopback, private, link-local, or cloud metadata endpoint - or by using a public URL that redirects to such a destination - the attacker causes the background sync worker to issue HTTP GET requests from the server's own network position, potentially exposing internal services or cloud instance metadata credentials. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a patch is available as an upstream commit from CIRCL.
Token replay in Vulnerability-Lookup's account activation and password-recovery mechanism allows an attacker who captures a valid one-time link to repeatedly reset the victim's password throughout the entire TOKEN_VALIDITY_PERIOD, even after the legitimate user has already consumed that token. Because the application never records whether a token has been used and does not bind tokens to a specific workflow, a single intercepted link grants persistent account-takeover capability without requiring any knowledge of the victim's current credentials. Reported by CIRCL, no public exploit code or CISA KEV listing exists at time of analysis; an upstream patch is available via a GitHub commit.
Inconsistent authorization enforcement in Vulnerability-Lookup's SSE streaming interface allows self-registered but unconfirmed or inactive accounts to subscribe to Pub/Sub event streams, accessing pre-moderation data that the REST API correctly restricts. The platform's self-registration flow issues an API key before account confirmation is complete, and the token_required decorator on /pubsub/subscribe/<topic> validated only that the key matched a known user - not that the account was active or confirmed. No public exploit has been identified at time of analysis, and a vendor-released patch correcting the authorization gap is confirmed available via upstream commit.
Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holding the vulnerability:create or vulnerability:modify permission to persist arbitrary JavaScript in public vulnerability record pages by submitting crafted reference tags via the CNA API. The flaw stems from markupsafe.Markup being applied to attacker-controlled tag values before HTML escaping, effectively suppressing Jinja's automatic sanitization and causing the payload to execute in any visitor's browser - including unauthenticated users - upon page load. No public exploit has been identified at time of analysis beyond the functional XSS payload embedded in the fix's test suite; a patch is available as upstream commit d29901655c50cf3c25737d9ea86180268df51b57.
SSRF guard bypass in Vulnerability Lookup's webhook notification subsystem allows a network attacker to register a webhook URL whose hostname resolves to an IPv6 transition address (NAT64, 6to4, Teredo, or IPv4-mapped), causing the application to issue server-side requests to private, loopback, or cloud metadata endpoints that should be blocked. The flaw stems from relying solely on Python's `is_global` property, which correctly returns True for IANA-routable transition prefixes but fails to inspect the private IPv4 address embedded within them. Exposure is strictly limited to organizations running the unreleased HEAD version of the application; no tagged release is affected, no public exploit has been identified, and the upstream fix has already landed.