Vineet Pandey

**Nome do software vulnerável e versões afetadas** Versões do node-red anteriores à 0.20.8 **Descrição** Existe uma vulnerabilidade de XSS armazenado no pacote npm do node-red, uma ferramenta visual para a conexão da Internet das Coisas. Isso permite que invasores roubem cookies de sessão e alterem o conteúdo de aplicativos web executando código JavaScript arbitrário no navegador da vítima. A vulnerabilidade decorre da falha na sanitização do campo `name` em novos Flows. **Recomendações** Atualize para a versão 0.20.8 ou posterior.

**Name of the Vulnerable Software and Affected Versions** http server versions all **Description** A path traversal issue exists, allowing an attacker to read arbitrary system files. Additionally, all versions of http server are vulnerable to Cross-Site Scripting (XSS) due to the failure to sanitize filenames, enabling attackers to execute arbitrary JavaScript in the victim's browser through files with malicious code in their names. **Recommendations** For all versions, consider using an alternative package until a fix is made available. As a temporary workaround, consider restricting access to sensitive system files and avoiding the use of filenames that could contain malicious code.

**Name of the Vulnerable Software and Affected Versions** Eclipse BIRT versions 1.0 through 4.7 **Description** The issue allows Reflected XSS in a URL parameter. An attacker can execute a payload in the victim's browser context. **Recommendations** For Eclipse BIRT versions 1.0 through 4.7, consider disabling the Report Viewer or restricting access to it until a patch is available to prevent Reflected XSS attacks.