Jens Mueller

**Name of the Vulnerable Software and Affected Versions** HCL Notes versions 9 through 11 **Description** The issue is related to an information leakage vulnerability through the support for the 'mailto' protocol. This could result in files from the user's filesystem or connected network filesystems being leaked to a third party. **Recommendations** For versions 9 through 11, consider disabling the 'mailto' protocol support as a temporary workaround until a patch is available. Restrict access to sensitive files on the user's filesystem and connected network filesystems to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** rack-cors versions prior to 0.4.1 **Description** The issue allows a malicious third-party site to perform CORS requests due to a missing anchor in the generated regex. This could lead to unintended domains being allowed if the configuration is set to trust specific domain names. For instance, if the configuration is intended to allow only the trusted `example.com` domain name and not the malicious `example.net` domain name, then `example.com.example.net` (as well as `example.com-example.net`) would be inadvertently allowed. **Recommendations** For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue.