Ferat Aydin

**Name of the Vulnerable Software and Affected Versions** Sage DPW versions 2024 12 004 and below Sage DPW version 2024.12.003 **Description** An Insecure Direct Object Reference (IDOR) exists in Sage DPW, allowing unauthorized attackers to access internal forms by sending a crafted GET request. **Recommendations** Update Sage DPW to a version later than 2024 12 004. Update Sage DPW to a version later than 2024.12.003.

**Name of the Vulnerable Software and Affected Versions** Sage DPW versions prior to 2024 12 004 **Description** Incorrect access control in Sage DPW allows unauthorized attackers to access the built-in Database Monitor via a crafted request. **Recommendations** Update to version 2024 12 004 or later.

**Name of the Vulnerable Software and Affected Versions** Sage DPW versions 2024.12.003 **Description** A reflected cross-site scripting (XSS) vulnerability exists in Sage DPW version 2024.12.003. This allows attackers to execute arbitrary JavaScript in the context of a victim’s browser by injecting a crafted payload into the `tabfields` parameter at the `/dpw/scripts/cgiip.exe/WService` API endpoint. **Recommendations** Upgrade to version 2024 12 004.

**Name of the Vulnerable Software and Affected Versions** OpenAtlas version 8.11.0 **Description** OpenAtlas v8.11.0 contains a hardcoded Administrator password. **Recommendations** Change the hardcoded Administrator password.

**Name of the Vulnerable Software and Affected Versions** Austrian Archaeological Institute (AI) OpenAtlas version 8.11.0 **Description** OpenAtlas contains a cross-site scripting (XSS) issue. Attackers can inject a crafted payload into the `Name` field, enabling the execution of arbitrary web scripts or HTML. **Recommendations** Update to a newer version of OpenAtlas that addresses this issue. As a temporary workaround, sanitize all user inputs to the `Name` field to prevent the injection of malicious scripts.

**Name of the Vulnerable Software and Affected Versions** OpenAtlas version 8.11.0 **Description** OpenAtlas contains a SQL injection vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.