Erickfernandox

**Name of the Vulnerable Software and Affected Versions** Alinto SOGo versions 5.12.3 through 5.12.4 **Description** A flaw exists in Alinto SOGo that allows for cross site scripting. The issue stems from manipulating the `hint` argument within an unknown function. This can be triggered remotely. The exploit is publicly available. The vendor was contacted regarding this issue but did not respond. **Recommendations** Update to a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mercurial SCM version 4.5.3 Description: A vulnerability was found in the Web Interface component of Mercurial SCM, where the manipulation of the `cmd` argument leads to cross-site scripting. The attack can be initiated remotely. Recommendations: For Mercurial SCM version 4.5.3, as a temporary workaround, consider restricting access to the Web Interface or disabling the manipulation of the `cmd` argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Hyland Alfresco Community Edition and Alfresco Enterprise Edition versions up to 6.2.2 **Description** A problematic vulnerability has been found in the URL Handler component of Hyland Alfresco Community Edition and Alfresco Enterprise Edition. This issue affects an unknown part of the file `/share/s/` and leads to cross-site scripting. The attack can be initiated remotely. It is recommended to upgrade the affected component to address this issue. **Recommendations** For versions up to 6.2.2, upgrade to version 7.0 to address this issue. As a temporary workaround, consider restricting access to the `/share/s/` endpoint of the URL Handler component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** openSUSE Tumbleweed MirrorCache versions prior to 1.083 **Description** A Cross-site Scripting vulnerability exists in openSUSE Tumbleweed MirrorCache, allowing the execution of arbitrary JavaScript via reflected XSS in the `REGEX` and `P` parameters. This issue affects versions before 1.083. **Recommendations** For versions prior to 1.083, update to version 1.083 or later to resolve the issue. As a temporary workaround, consider restricting access to the `REGEX` and `P` parameters in the affected API endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TOTVS Fluig Platform versions 1.6.x through 1.8.1 **Description** A problematic issue was found in the TOTVS Fluig Platform, affecting some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument `redirectUrl/user` with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. **Recommendations** For TOTVS Fluig Platform versions 1.6.x, 1.7.x, and 1.8.0, upgrade to version 1.7.1-231128, 1.8.0-231127 respectively. For TOTVS Fluig Platform version 1.8.1, upgrade to version 1.8.1-231127.