Jean-Marie Bourbon

**Name of the Vulnerable Software and Affected Versions** Beghelli Sicuro24 SicuroWeb (affected versions not specified) **Description** Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy (CSP), which is a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. This absence allows the unrestricted loading of external JavaScript resources from attacker-controlled origins. When combined with template injection and sandbox escape issues within the application, this lack of CSP removes browser-enforced restrictions, enabling the loading of arbitrary remote payloads into operator browser sessions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Beghelli Sicuro24 SicuroWeb (affected versions not specified) **Description** The software embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection within the application, these primitives allow attackers to escape the AngularJS sandbox and execute arbitrary JavaScript in operator browser sessions. This can lead to session hijacking, DOM manipulation, and persistent browser compromise. In plaintext HTTP deployments, network-adjacent attackers can deliver the injection and escape chain via a Man-in-the-Middle (MITM) attack without active user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.47 **Description** The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can change `User-Agent` headers to reset rate limits, request nonces from the unauthenticated `/wpdGetNonce` API endpoint, and vote multiple times using techniques like IP rotation or reverse proxy header manipulation. **Recommendations** Update wpDiscuz to version 7.6.47 or later.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.47 **Description** The software contains a stored cross-site scripting issue that permits authenticated attackers to inject malicious JavaScript. This is achieved by importing a specially crafted options file containing unescaped custom CSS field values. Attackers can provide a malicious JSON import file with script payloads within the `customCss` parameter. These payloads execute on every page when rendered through the options handler due to insufficient sanitization. **Recommendations** Update wpDiscuz to version 7.6.47 or later.

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.47 **Description** The software contains a shortcode injection issue that allows attackers to execute arbitrary shortcodes. This is achieved by including shortcodes in comment content sent via email notifications. Attackers can inject shortcodes such as `[contact-form-7]` or `[user meta]` within comments. These shortcodes are executed server-side when the `WpdiscuzHelperEmail` class processes notifications through the `do shortcode()` function before `wp mail()`. The `do shortcode()` function is used to process shortcodes within the comment content. **Recommendations** Update wpDiscuz to version 7.6.47 or later.

**Name of the Vulnerable Software and Affected Versions** Moodle versions 3.5.x through 3.5.3 **Description** The issue allows for a Server-Side Request Forgery (SSRF) attack. A registered user can exploit the `edit blog.php` script by adding a malicious URL or TCP port to target internal networks or internet-hosted servers, bypassing firewall rules and IP filtering. This is a "blind" vulnerability, as there is no response available on the Moodle website, requiring attackers to use a "time-based" approach to exploit it. **Recommendations** For Moodle versions 3.5.x through 3.5.3, update to version 3.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `edit blog.php` script to minimize the risk of exploitation. Avoid using the `edit blog.php` script to add external RSS feed resources until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 6.13.1 Description: The issue allows an authenticated user to download a deleted page via the word export feature. Recommendations: For versions prior to 6.13.1, update to version 6.13.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers versions prior to 10.11.013310 Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers versions 10.12.x prior to 10.12.013309 **Description** The issue allows local users to conduct a jailbreak attack and obtain root privileges by overwriting the /etc/shadow file, due to /usr/bin/lua being installed setuid to the itadmin account. This enables a BusyBox jailbreak attack. **Recommendations** For versions prior to 10.11.013310, update to version 10.11.013310 or later. For versions 10.12.x prior to 10.12.013309, update to version 10.12.013309 or later. As a temporary workaround, consider restricting access to the /usr/bin/lua executable until a patch is available.