Fernando Quintero

**Name of the Vulnerable Software and Affected Versions** MoinMoin versions 1.5.x through 1.5.8 MoinMoin versions 1.6.x before 1.6.1 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the login action. **Recommendations** For MoinMoin versions 1.5.x through 1.5.8, update to version 1.6.1 or later. For MoinMoin versions 1.6.x before 1.6.1, update to version 1.6.1 or later.

**Name of the Vulnerable Software and Affected Versions** Cacti version 0.8.5a **Description** The issue allows remote attackers to gain sensitive information via an HTTP request to certain PHP files, including "auth.php", "auth login.php", and "auth changepassword.php". These files can reveal the installation path in a PHP error message. **Recommendations** For Cacti version 0.8.5a, consider restricting access to the affected PHP files, such as "auth.php", "auth login.php", and "auth changepassword.php", to minimize the risk of exploitation. Additionally, ensure that PHP error messages are properly configured to prevent the disclosure of sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cacti version 0.8.5a **Description** The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This can be achieved via the `username` or `password` parameters. **Recommendations** For Cacti version 0.8.5a, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the auth login.php module to minimize the risk of exploitation. Avoid using the `username` and `password` parameters in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LinPHA version 0.9.4 **Description** The issue allows remote attackers to execute arbitrary SQL code and bypass authentication. This is achieved via the `linpha userid` or `linpha password` cookies. **Recommendations** For LinPHA version 0.9.4, update to a version that fixes the SQL injection issue to prevent remote attackers from executing arbitrary SQL code and bypassing authentication.

**Name of the Vulnerable Software and Affected Versions** Jaws Framework and Content Management System version 0.4 **Description** The issue allows remote attackers to execute arbitrary SQL and bypass authentication. This can be achieved via the `user`, `password`, or `crypted password` parameters. **Recommendations** For Jaws Framework and Content Management System version 0.4, consider restricting access to the controlpanel.php file until a patch is available. As a temporary workaround, avoid using the `user`, `password`, or `crypted password` parameters in the affected API endpoint. At the moment, there is no information about a newer version that contains a fix for this vulnerability.