Jean-Marie Bourbon

**Name of the Vulnerable Software and Affected Versions** Beghelli Sicuro24 SicuroWeb (versões afetadas não especificadas) **Description** O Beghelli Sicuro24 SicuroWeb não impõe uma Política de Segurança de Conteúdo (CSP), que é uma camada de segurança que ajuda a detectar e mitigar certos tipos de ataques, incluindo Cross-Site Scripting (XSS) e ataques de injeção de dados. Essa ausência permite o carregamento irrestrito de recursos JavaScript externos de origens controladas por atacantes. Quando combinado com problemas de injeção de template e escape de sandbox na aplicação, a falta de CSP remove as restrições impostas pelo navegador, permitindo o carregamento de payloads remotos arbitrários nas sessões de navegador do operador. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Beghelli Sicuro24 SicuroWeb (versões afetadas não especificadas) **Description** O software incorpora o AngularJS 1.5.2, um componente em fim de vida que contém primitivas conhecidas de escape de sandbox. Quando combinadas com a injeção de template presente na aplicação, essas primitivas permitem que atacantes escapem da sandbox do AngularJS e executem JavaScript arbitrário em sessões de navegador de operadores. Isso pode levar ao sequestro de sessão, manipulação de DOM e comprometimento persistente do navegador. Em implementações HTTP em texto simples, atacantes adjacentes à rede podem entregar a cadeia de injeção e escape via ataque Man-in-the-Middle (MITM) sem a interação ativa do usuário. **Recommendations** No momento, não há informações sobre uma versão mais recente que contenha a correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.47 **Description** The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change `User-Agent` headers to reset rate limits, request nonces from the unauthenticated `/wpdGetNonce` API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation. **Recommendations** Update wpDiscuz to version 7.6.47 or later.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.47 **Description** The software contains a stored cross-site scripting issue that permits authenticated attackers to inject malicious JavaScript. This is achieved by importing a specially crafted options file containing unescaped custom CSS field values. Attackers can provide a malicious JSON import file with script payloads within the `customCss` parameter. These payloads execute on every page when rendered through the options handler due to insufficient sanitization. **Recommendations** Update wpDiscuz to version 7.6.47 or later.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.47 **Description** The software contains a shortcode injection issue that allows attackers to execute arbitrary shortcodes. This is achieved by including shortcodes in comment content sent via email notifications. Attackers can inject shortcodes such as `[contact-form-7]` or `[user meta]` within comments. These shortcodes are executed server-side when the `WpdiscuzHelperEmail` class processes notifications through the `do shortcode()` function before `wp mail()`. The `do shortcode()` function is used to process shortcodes within the comment content. **Recommendations** Update wpDiscuz to version 7.6.47 or later.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 3.5.x through 3.5.3 **Description** The issue allows for a Server-Side Request Forgery (SSRF) attack. A registered user can exploit the `edit blog.php` script by adding a malicious URL or TCP port to target internal networks or internet-hosted servers, bypassing firewall rules and IP filtering. This is a "blind" vulnerability, as there is no response available on the Moodle website, requiring attackers to use a "time-based" approach to exploit it. **Recommendations** For Moodle versions 3.5.x through 3.5.3, update to version 3.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `edit blog.php` script to minimize the risk of exploitation. Avoid using the `edit blog.php` script to add external RSS feed resources until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 6.13.1 Description: The issue allows an authenticated user to download a deleted page via the word export feature. Recommendations: For versions prior to 6.13.1, update to version 6.13.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers versions prior to 10.11.013310 Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers versions 10.12.x prior to 10.12.013309 **Description** The issue allows local users to conduct a jailbreak attack and obtain root privileges by overwriting the /etc/shadow file, due to /usr/bin/lua being installed setuid to the itadmin account. This enables a BusyBox jailbreak attack. **Recommendations** For versions prior to 10.11.013310, update to version 10.11.013310 or later. For versions 10.12.x prior to 10.12.013309, update to version 10.12.013309 or later. As a temporary workaround, consider restricting access to the /usr/bin/lua executable until a patch is available.