Nuxsmin

**Name of the Vulnerable Software and Affected Versions** SysPass versions 3.2.x **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `name` parameter at the "/Controllers/ClientController.php" endpoint. This enables attackers to potentially execute arbitrary code. **Recommendations** For SysPass version 3.2.x, update the system as soon as possible and validate inputs to prevent exploitation. Consider temporarily restricting access to the ClientController.php until a patch is available.

**Name of the Vulnerable Software and Affected Versions** nuxsmin sysPass versions up to 3.2.4 **Description** A problematic vulnerability was found in the URL Handler component, leading to cross-site scripting. The attack can be launched remotely. **Recommendations** For versions up to 3.2.4, upgrade to version 3.2.5 to address this issue.

**Name of the Vulnerable Software and Affected Versions** sysPass versions 2.0 through 2.1 **Description** An issue was discovered in sysPass where an algorithm was never sufficiently reviewed by cryptographers. The use of the MCRYPT RIJNDAEL 256() function, which is the 256-bit block version of Rijndael and not AES, could potentially help an attacker create havoc in the remote system. **Recommendations** For sysPass versions 2.0 through 2.1, update to version 2.1 or later to resolve the issue.