Chen Ruiqi

**Name of the Vulnerable Software and Affected Versions** ovirt versions 4.4 and earlier **Description** A flaw was found in Ovirt Engine's web interface where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context. **Recommendations** For ovirt versions 4.4 and earlier, update to a version that includes the fix for this issue to prevent reflected cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** oVirt-engine versions 4.4 and earlier **Description** The issue allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer visible. The highest threat from this vulnerability is on confidentiality. It is related to the use of open redirect, which can be exploited by a remote attacker to redirect a user to a specially crafted link. **Recommendations** For versions 4.4 and earlier, update to a version later than 4.4 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NETGEAR WC7500 versions prior to 6.5.3.9 NETGEAR WC7520 versions prior to 6.5.3.9 NETGEAR WC7600v1 versions prior to 6.5.3.9 NETGEAR WC7600v2 versions prior to 6.5.3.9 **Description** The issue allows command injection by an unauthenticated attacker. **Recommendations** For NETGEAR WC7500 versions prior to 6.5.3.9, update to version 6.5.3.9 or later. For NETGEAR WC7520 versions prior to 6.5.3.9, update to version 6.5.3.9 or later. For NETGEAR WC7600v1 versions prior to 6.5.3.9, update to version 6.5.3.9 or later. For NETGEAR WC7600v2 versions prior to 6.5.3.9, update to version 6.5.3.9 or later.

**Name of the Vulnerable Software and Affected Versions** Cacti version 1.1.17 **Description** A cross-site scripting issue exists in the `method` parameter in `spikekill.php`. **Recommendations** For Cacti version 1.1.17, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Joomla! versions 3.2.0 through 3.6.5 **Description** The issue is related to inadequate filtering, which leads to cross-site scripting (XSS) in the template manager component. **Recommendations** For versions 3.2.0 through 3.6.5, update to version 3.7.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** b2evolution versions 6.7.5 and earlier **Description** A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the site name. This could potentially lead to unauthorized actions on the site. **Recommendations** For b2evolution versions 6.7.5 and earlier, update to a version later than 6.7.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Dotclear versions prior to 2.10 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the media manager. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the `q` and `link type` parameters to the "admin/media.php" endpoint are vulnerable. **Recommendations** For versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the `admin/media.php` endpoint and avoid using the `q` and `link type` parameters until the issue is resolved.