Farouk

**Name of the Vulnerable Software and Affected Versions** Ingenico Estate Manager version 2023 **Description** A problematic vulnerability was found in the New Widget Handler component, affecting an unknown functionality of the file /emgui/rest/preferences/PREF HOME PAGE/sponsor/3/. The manipulation of the `URL` argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Ingenico Estate Manager version 2023, as a temporary workaround, consider restricting access to the `/emgui/rest/preferences/PREF HOME PAGE/sponsor/3/` endpoint until a patch is available. Avoid using the `URL` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LabVantage LIMS version 2017 WPML (affected versions not specified) **Description** A problematic issue affects the processing of the file "/labvantage/rc?command=page" of the component POST Request Handler. The manipulation of the argument `param1` leads to cross-site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This issue may allow an attacker to execute arbitrary code on the vulnerable server. **Recommendations** For LabVantage LIMS version 2017, consider disabling the `param1` argument in the POST Request Handler until a patch is available. For WPML, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LabVantage LIMS version 2017 **Description** A vulnerability was found in the component POST Request Handler, affecting the file /labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp. The manipulation of the argument `sdcid/keyid1/keyid2/keyid3` leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For LabVantage LIMS version 2017, as a temporary workaround, consider restricting access to the `POST Request Handler` component until a patch is available. Avoid using the argument `sdcid/keyid1/keyid2/keyid3` in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LabVantage LIMS version 2017 **Description** A problematic vulnerability has been found in the software. The issue affects an unknown function of the file /labvantage/rc?command=page&sdcid=LV ReagentLot of the component POST Request Handler. The manipulation of the `mode` argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For LabVantage LIMS version 2017, consider restricting access to the vulnerable POST Request Handler component to minimize the risk of exploitation. As a temporary workaround, avoid using the `mode` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LabVantage LIMS version 2017 **Description** A problematic issue was found in the file `/labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp` of the component POST Request Handler. The manipulation of the `bulletinbody` argument leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For LabVantage LIMS version 2017, consider restricting access to the `/labvantage/rc?command=file&file=WEB-OPAL/pagetypes/bulletins/sendbulletin.jsp` endpoint until a patch is available. As a temporary workaround, avoid using the `bulletinbody` argument in the affected POST Request Handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LabVantage LIMS version 2017 **Description** A vulnerability in LabVantage LIMS allows for cross-site scripting (XSS) attacks. The issue is related to the manipulation of the `height` and `width` arguments in the file `/labvantage/rc?command=file&file=WEB-CORE/elements/files/filesembedded.jsp&size=32`. This can be exploited remotely. The vendor was contacted about this issue but did not respond. **Recommendations** For LabVantage LIMS version 2017, as a temporary workaround, consider restricting access to the `/labvantage/rc` API endpoint or disabling the manipulation of the `height` and `width` parameters in the file `filesembedded.jsp` until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Ingenico Estate Manager version 2023 Description: A problematic issue has been found in the News Feed component, affecting the processing of the file /emgui/rest/ums/messages. The manipulation of the `message` argument leads to cross-site scripting. The attack can be initiated remotely. The vendor was contacted about this disclosure but did not respond. Recommendations: For Ingenico Estate Manager version 2023, as a temporary workaround, consider restricting access to the /emgui/rest/ums/messages file until a patch is available. Avoid using the `message` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: LabVantage LIMS version 2017 Description: A problematic vulnerability has been found in LabVantage LIMS, affecting an unknown part of the file "/labvantage/rc?command=page&page=SampleHistoricalList& iframename=list& crc=crc 1701669816260". The manipulation of the `height` and `width` arguments leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: For LabVantage LIMS version 2017, as a temporary workaround, consider restricting access to the affected file "/labvantage/rc?command=page&page=SampleHistoricalList& iframename=list& crc=crc 1701669816260" to minimize the risk of exploitation. Avoid using the `height` and `width` arguments in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LabVantage LIMS version 2017 **Description** The issue is related to the lack of protection of the web page structure in the LabVantage LIMS laboratory information system. This can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack through the `sdcid/keyid1` parameters in the `/labvantage/rc?command=page&page=LV ViewSampleSpec&oosonly=Y& sdialog=Y` file. The attack may be initiated remotely. **Recommendations** For LabVantage LIMS version 2017, consider disabling access to the `/labvantage/rc` file or restricting the use of the `sdcid/keyid1` parameters until a patch is available. Avoid using the `sdcid/keyid1` parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: LabVantage LIMS version 2017 Description: A critical vulnerability was found in LabVantage LIMS, affecting the component POST Request Handler. The issue is related to the manipulation of the `param1` argument in the file `/labvantage/rc?command=page&page=SampleList& iframename=list`, which leads to SQL injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Recommendations: For LabVantage LIMS version 2017, consider disabling the `param1` argument in the affected API endpoint until a patch is available. Restrict access to the `/labvantage/rc?command=page&page=SampleList& iframename=list` endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.