Fabian Funder

**Name of the Vulnerable Software and Affected Versions** Suprema BioStar 2 version 2.9.11.6 **Description** BioStar 2 version 2.9.11.6 allows users to set a new password without providing the current password. Exploiting this flaw, in combination with other vulnerabilities, can lead to unauthorized account access and potential system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Laravel framework versions 11.9.0 through 11.35.1 **Description** The issue is related to reflected cross-site scripting due to improper encoding of request parameters in the debug-mode error page. **Recommendations** For Laravel framework versions 11.9.0 through 11.35.1, update to a version that properly encodes request parameters in the debug-mode error page to prevent reflected cross-site scripting.

**Name of the Vulnerable Software and Affected Versions** Laravel framework versions 11.9.0 through 11.35.1 **Description** The issue is related to reflected cross-site scripting due to improper encoding of route parameters in the debug-mode error page. **Recommendations** For versions 11.9.0 through 11.35.1, update to a version that properly encodes route parameters in the debug-mode error page to prevent reflected cross-site scripting.

**Name of the Vulnerable Software and Affected Versions** Paradox IP150 Internet Module version 1.40.00 **Description** The issue is related to Cross-Site Request Forgery (CSRF) attacks, which can be executed due to the lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system. **Recommendations** For Paradox IP150 Internet Module version 1.40.00, consider disabling the use of the `GET` method for introducing system changes until a patch is available. Restrict access to sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CraftCMS plugin Two-Factor Authentication versions 3.3.1 through 3.3.3 **Description** The issue discloses the password hash of the currently authenticated user after submitting a valid TOTP. **Recommendations** For versions 3.3.1 through 3.3.3, consider disabling the Two-Factor Authentication plugin until a patch is available to prevent the disclosure of password hashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CraftCMS plugin Two-Factor Authentication versions 3.3.3 and earlier **Description** The issue allows reuse of TOTP tokens multiple times within the validity period. **Recommendations** For versions 3.3.3 and earlier, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting the use of TOTP tokens to minimize the risk of exploitation.