Olivier Beg

**Name of the Vulnerable Software and Affected Versions** unoconv versions prior to 0.9 **Description** The issue is related to insufficient validation of incoming requests in the LibreOffice Unoconv document format converter. This allows a remote attacker to access confidential data. The vulnerability is also associated with the mishandling of untrusted pathnames, leading to Server-Side Request Forgery (SSRF) and local file inclusion. **Recommendations** For versions prior to 0.9, update to version 0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the unoconv package to minimize the risk of exploitation. Avoid using untrusted pathnames in the affected package until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Userscape HelpSpot versions prior to 4.7.2 Description: A reflected cross-site scripting issue exists in the "return" parameter of the "index.php?pg=moderated" API endpoint. It executes when the return link is clicked. Recommendations: For versions prior to 4.7.2, update to version 4.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php?pg=moderated" endpoint until a patch is applied. Avoid using the `return` parameter in the affected endpoint until the issue is resolved.