Mikko Korpi

**Name of the Vulnerable Software and Affected Versions** Profisee versions 2020R1 through 2024R1 **Description** The issue is related to an Improper Input Validation vulnerability in the filesystem modules of Profisee on Windows, allowing Path Traversal after authentication to the Profisee system. **Recommendations** For versions 2020R1 through 2024R1, update to version 2024R2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sparx Systems Pro Cloud Server versions earlier than 6.0.165 **Description** A Cross-Site Request Forgery (CSRF) issue is present in the whole application, allowing for Session Hijacking. This issue can be used to change the Pro Cloud Server Configuration password. **Recommendations** For versions earlier than 6.0.165, update to version 6.0.165 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration password change functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sparx Systems Pro Cloud Server versions earlier than 6.0.165 **Description** The issue is related to an Improper Input Validation vulnerability in the WebEA model search field of Sparx Systems Pro Cloud Server, which allows Cross-Site Scripting (XSS). **Recommendations** For versions earlier than 6.0.165, update to version 6.0.165 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Sparx Systems Pro Cloud Server versions earlier than 6.0.165 **Description** The issue is caused by an Improper Limitation of a Pathname, leading to a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in the logview.php file and allows reading arbitrary files on the filesystem. The logview is accessible through the Pro Cloud Server Configuration interface. **Recommendations** For versions earlier than 6.0.165, update to version 6.0.165 or later to resolve the issue. As a temporary workaround, consider restricting access to the logview.php file until a patch is available. Avoid using the logview feature in the Pro Cloud Server Configuration interface until the issue is resolved.