Dylangrl

Name of the Vulnerable Software and Affected Versions: Alteryx Server version 2023.1.1.460 Description: An insecure permissions issue in the local storage component of Alteryx Server allows remote attackers to obtain valid user session tokens from localStorage, potentially leading to account takeover. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Alteryx Server version 2023.1.1.460 Description: An issue in Alteryx Server allows for HTML injection through a manipulated script within the pages component. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Alteryx Server version 2022.1.1.42590 **Description** The issue exists due to the lack of protection for the web page structure in Alteryx Server, allowing remote attackers to perform cross-site scripting (XSS) attacks via the `type` field using a PUT request to the "/gallery/api/media" endpoint. This vulnerability also enables attackers to upload arbitrary files, such as JavaScript content for stored XSS, by changing the file extension. **Recommendations** For Alteryx Server version 2022.1.1.42590, consider disabling the ability to upload files via the "/gallery/api/media" endpoint until a patch is available. Restrict access to the `type` field in the JSON document within the PUT request to minimize the risk of exploitation. As a temporary workaround, implement file type verification for uploaded files to prevent attackers from uploading arbitrary files.

**Name of the Vulnerable Software and Affected Versions** FileCloud versions 20.2 and later **Description** The issue allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a crafted HTTP request. **Recommendations** For FileCloud versions 20.2 and later, at the moment, there is no information about a newer version that contains a fix for this vulnerability.