Elwood Buck

**Name of the Vulnerable Software and Affected Versions** SAS/Intrnet versions 9.4 build 1520 and earlier **Description** The issue allows Local File Inclusion. The samples library, included by default in the appstart.sas file, enables end-users to access the sample.webcsf1.sas program. This program contains user-controlled macro variables passed to the DS2CSF macro. Users can escape the context of the configured user-controllable variable and append additional functions native to the macro but not included as variables within the library. This includes a function that retrieves files from the host OS. **Recommendations** For SAS/Intrnet versions 9.4 build 1520 and earlier, consider disabling access to the sample.webcsf1.sas program until a patch is available. Restrict the use of the DS2CSF macro to minimize the risk of exploitation. Avoid using user-controlled macro variables in the affected library to prevent escaping the context of the configured variable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ArcGIS Server versions 10.8.1 and earlier Description: A SQL injection issue exists in some configurations, allowing specially crafted web requests to expose unintended information. This does not affect customer datasets. Web Services using file-based data sources, such as file Geodatabase, Shape Files, or tile cached services, are not affected by this issue. Recommendations: For ArcGIS Server versions 10.8.1 and earlier, consider restricting access to sensitive data until a fix is available. As a temporary workaround, review and secure web request handling to prevent exploitation of the SQL injection issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kronos Web Time and Attendance (webTA) versions 3.8.x through 3.x before 4.0 **Description** A stored XSS issue affects the software via multiple input fields, including `Login Message`, `Banner Message`, and `Password Instructions`, of the `com.threeis.webta.H261configMenu` servlet. This can be exploited by an authenticated administrator. **Recommendations** For versions 3.8.x through 3.x before 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `com.threeis.webta.H261configMenu` servlet for authenticated administrators until a patch is available. Avoid using the vulnerable input fields (`Login Message`, `Banner Message`, and `Password Instructions`) in the affected servlet until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Kronos Web Time and Attendance (webTA) versions 4.1.x through 4.x before 5.0 **Description** The issue concerns a Stored XSS vulnerability. It can be triggered by setting the Application Banner input field of the "/ApplicationBanner" page as an authenticated administrator. **Recommendations** For versions 4.1.x through 4.x before 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ApplicationBanner" page for authenticated administrators until a patch is available. Avoid using the Application Banner input field in the affected page until the issue is resolved.