Edr4

**Name of the Vulnerable Software and Affected Versions** osticket versions prior to 1.16.6 **Description** The issue is related to Cross-site Scripting (XSS) - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the application, potentially allowing the attacker to steal user data or take control of user sessions. **Recommendations** For versions prior to 1.16.6, update to version 1.16.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 10.0.6 **Description** The issue concerns cross-site scripting via malicious RSS feeds. An administrator can import a malicious RSS feed containing Cross Site Scripting (XSS) payloads inside RSS links. When victims visit the RSS content and click on the link, they will execute the Javascript. **Recommendations** For versions prior to 10.0.6, update to version 10.0.6 to resolve the issue. As a temporary workaround, consider restricting the import of RSS feeds from untrusted sources to minimize the risk of exploitation. Avoid clicking on links from RSS feeds that may contain malicious payloads until the issue is resolved.

**Nome do software vulnerável e versões afetadas** Versões do GLPI anteriores à 10.0.3 **Descrição** O problema está relacionado à falta de neutralização de tags HTML durante a geração de páginas da web, o que pode permitir que um invasor remoto realize um ataque de script entre sites (XSS). As versões afetadas não neutralizam adequadamente as tags HTML no contexto da pesquisa global. **Recomendações** Para versões anteriores à 10.0.3, atualize para a versão 10.0.3 para resolver este problema. Para usuários que não possam atualizar, desative a pesquisa global como uma solução alternativa temporária.