Crashpark

**Name of the Vulnerable Software and Affected Versions** Vermeg Agile Reporter version 23.2.1 **Description** The issue is a stored cross-site scripting (XSS) that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Message` field under the Set Broadcast Message module. This enables attackers to potentially manipulate the web application's behavior or steal user data. **Recommendations** For Vermeg Agile Reporter version 23.2.1, consider disabling the Set Broadcast Message module or restricting access to it until a patch is available to prevent exploitation of the stored XSS issue. Additionally, avoid using the `Message` field in the Set Broadcast Message module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VERMEG AgileReporter version 21.3 **Description** An issue was discovered in VERMEG AgileReporter where XXE can occur via an XML document to the Analysis component. **Recommendations** For VERMEG AgileReporter version 21.3, consider restricting access to the Analysis component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using XML documents that may trigger the XXE issue in the Analysis component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VERMEG AgileReporter version 21.3 **Description** An issue was discovered in the Analysis component, allowing an admin to enter an XSS payload. **Recommendations** For VERMEG AgileReporter version 21.3, consider restricting access to the Analysis component until a patch is available. As a temporary workaround, avoid using the Analysis component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VERMEG AgileReporter version 21.3 **Description** An issue was discovered in VERMEG AgileReporter where attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log. **Recommendations** For VERMEG AgileReporter version 21.3, consider disabling the Add Comment action to the Activity log until a patch is available to prevent exploitation via XSS payload.