Claudio Cinquino

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 5.6.6 **Description** The issue is related to stored XSS due to the lack of filtration of user-supplied data in the Create Task feature. An attacker can modify the `name` parameter to contain JavaScript code, potentially leading to malicious actions. **Recommendations** For versions prior to 5.6.6, update to version 5.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Create Task feature until the update is applied. Avoid using the `name` parameter in the Create Task feature until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Joomla! ProFiles component version 1.5 **Description** A security issue exists in the ProFiles component for Joomla!, specifically when creating a new folder in the administrative panel. The `name` or `path` parameter is vulnerable to XSS attacks. **Recommendations** For Joomla! ProFiles component version 1.5, avoid using the `name` or `path` parameter when creating a new folder in the administrative panel until a patch is available. As a temporary workaround, consider restricting access to the folder creation functionality in the administrative panel to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OverIT Geocall versions 6.3 before build 2:346977 **Description** Multiple XSS vulnerabilities were discovered. **Recommendations** For OverIT Geocall version 6.3, update to a version after build 2:346977 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OverIT Geocall versions prior to 6.3 build 2:346977 **Description** An issue allows an unauthenticated attacker to obtain a cookie of an authenticated user and login to the web application through an unauthenticated servlet. **Recommendations** For versions prior to 6.3 build 2:346977, update to a version that includes build 2:346977 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** McAfee Security Information and Event Management (SIEM) version 9.6.0 MR3 **Description** An issue in McAfee Security Information and Event Management (SIEM) allows an administrator to bypass authentication and make changes to other SIEM users' information, including user passwords, without providing the current administrator password a second time via the GUI or GUI terminal commands. **Recommendations** For McAfee Security Information and Event Management (SIEM) version 9.6.0 MR3, consider restricting access to user information management features until a fix is available. As a temporary workaround, limit the use of the GUI and GUI terminal commands for making changes to user passwords to minimize the risk of exploitation.