Certus Cybersecurity

Name of the Vulnerable Software and Affected Versions: Equalize Digital Accessibility Checker versions n/a through 1.31.0 Description: The Accessibility Checker by Equalize Digital is affected by a missing authorization issue. This allows exploitation due to incorrectly configured access control security levels. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Equalize Digital Accessibility Checker versions through 1.31.0 Description: An authorization issue exists in Equalize Digital Accessibility Checker due to incorrectly configured access control security levels. This allows for potential unauthorized access. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: URBAN BASE Z-Downloads versions 1.11.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions 1.11.7 and earlier, update to a version that contains a fix for this issue, as no specific workaround is provided for these versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Media Library Assistant versions prior to 3.20 **Description** The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for command injection, which can be exploited by attackers. The estimated number of potentially affected devices is not provided, and there is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 3.20, update to a version 3.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `Media Library Assistant` module to minimize the risk of exploitation. Avoid using the `Media Library Assistant` functionality in sensitive environments until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Bit Form – Contact Form Plugin versions 2.13.11 and earlier **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions 2.13.11 and earlier, update to a version later than 2.13.11 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's database interactions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Web Directory Free versions 1.7.3 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows Reflected XSS. **Recommendations** For versions 1.7.3 and earlier, update to a version later than 1.7.3 to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Bit Form – Contact Form Plugin versions n/a through 2.13.10 **Description** The issue allows for the unrestricted upload of files with dangerous types, which can lead to code injection. This can potentially be exploited by attackers to inject malicious code. **Recommendations** For versions n/a through 2.13.10, update to a version later than 2.13.10 to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types until a patch is available. Restrict access to the file upload functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Spiffy Calendar versions through 4.9.12 **Description** The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. **Recommendations** For versions through 4.9.12, update to a version later than 4.9.12 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database operations to minimize the risk of exploitation.