Callum Carney

**Name of the Vulnerable Software and Affected Versions** Grafana Image Renderer versions 1.0.0 through 4.0.16 **Description** Grafana Image Renderer is susceptible to remote code execution due to an arbitrary file write issue. The `/render/csv` API endpoint lacks proper validation of the `filePath` parameter, allowing an attacker to save a shared object to an arbitrary location. This saved object is then loaded by the Chromium process. Successful exploitation requires either the default token (`authToken`) to be unchanged or known to the attacker, and the attacker must be able to reach the image renderer endpoint. **Recommendations** Versions 1.0.0 through 4.0.16 should be updated.

**Name of the Vulnerable Software and Affected Versions** JetBrains Space versions prior to 2020-04-22 **Description** The issue allows stored XSS in Chats. **Recommendations** For versions prior to 2020-04-22, update to a version released after 2020-04-22 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** JetBrains Space versions prior to 2020-04-22 **Description** The session timeout period in JetBrains Space was configured improperly, which could lead to issues. **Recommendations** For versions prior to 2020-04-22, update the configuration to properly set the session timeout period.

**Name of the Vulnerable Software and Affected Versions** JetBrains Space versions prior to 2020-04-22 **Description** The password authentication implementation in JetBrains Space was insecure. **Recommendations** For versions prior to 2020-04-22, update to a version released after 2020-04-22 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.7.1 Moodle versions prior to 3.6.5 Moodle versions prior to 3.5.7 Description: A flaw was found in the XML loading/unloading admin tool where a sesskey (CSRF) token was not being utilized. Recommendations: For versions prior to 3.7.1, update to version 3.7.1 or later. For versions prior to 3.6.5, update to version 3.6.5 or later. For versions prior to 3.5.7, update to version 3.5.7 or later.