Manuel Kiesel

**Name of the Vulnerable Software and Affected Versions** Lenovo Vantage and Lenovo Baiying versions (affected versions not specified) **Description** An input validation issue exists in the LenovoProductivitySystemAddin used within Lenovo Vantage and Lenovo Baiying. A locally authenticated user could potentially terminate arbitrary processes with elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lenovo Vantage versions (affected versions not specified) Lenovo Baiying versions (affected versions not specified) **Description** An input validation issue exists in the DeviceSettingsSystemAddin component used within Lenovo Vantage and Lenovo Baiying. A local authenticated user could potentially modify arbitrary registry keys with elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lenovo Vantage and Lenovo Baiying versions (affected versions not specified) **Description** An input validation issue exists in the DeviceSettingsSystemAddin component used within Lenovo Vantage and Lenovo Baiying. A local authenticated user could potentially delete arbitrary registry keys with elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BestInformed Web (affected versions not specified) **Description** The issue arises from improper sanitization of user input in the BestInformed Web application, leading to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker can compromise the sessions of other users on the server by injecting JavaScript code into their sessions. This could enable a form of horizontal movement, as the compromised users might have more privileges than the attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bestinformed Infoclient (affected versions not specified) **Description** A low-privileged user can change the server address of the bestinformed Server to which the bestinformed Infoclient connects, allowing them to escalate their privileges by abusing certain features of the bestinformed Web server. These features include pushing malicious update packages and arbitrary registry read as nt authoritysystem. An attacker can escalate their privileges to nt authoritysystem on the Windows client running the bestinformed Infoclient. This attack is not possible if a custom configuration (Infoclient.ini) containing the flags ShowOnTaskbar=false or DisabledItems=stPort,stAddress is deployed. **Recommendations** For bestinformed Infoclient, consider implementing a custom configuration (Infoclient.ini) with the flags ShowOnTaskbar=false or DisabledItems=stPort,stAddress to prevent the server address from being changed. As a temporary workaround, restrict access to the bestinformed Infoclient GUI to minimize the risk of exploitation. Avoid using the default server address configuration until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BestInformed Web (affected versions not specified) **Description** The issue allows an authenticated user in the BestInformed Web application to execute commands on the underlying server running the application, which is a case of remote code execution. This can be achieved by creating `ScriptVars` with the type `script` and previewing them, for example, by creating a new information entry. By default, admin users have the necessary permissions, but with the granular permission system, these permissions can be assigned to other users as well. If an account with the correct permissions is compromised, an attacker can execute commands on the server running the BestInformed Web application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** bestinformed Web (affected versions not specified) **Description** The issue arises from improper sanitization of user input in the bestinformed Web application, leading to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker can inject JavaScript code into user sessions, compromising them and potentially abusing the privileges of those users within the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Easy Tax Client Software 2023 versions 1.2 and earlier **Description** A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software across multiple platforms, including Windows, Linux, and macOS. **Recommendations** For Easy Tax Client Software 2023 version 1.2 and earlier, consider disabling the XML parsing functionality until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.