Timo Müller

**Name of the Vulnerable Software and Affected Versions** syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket versions 3.4.0.x **Description** An authentication bypass exists where an attacker with valid user credentials can circumvent the two-factor authentication (2FA) flow. By sending HTTP requests with a crafted `User-Agent` header containing specific strings such as AtlassianMobileApp or JIRA, the plugin fails to enforce 2FA checks for protected web resources. This allows unauthorized access to the Atlassian application as the compromised user. If the account possesses administrative privileges, the attacker can access administrative functions, potentially disabling the 2FA plugin or making arbitrary changes. **Recommendations** Update to version 3.5.0.0.

**Name of the Vulnerable Software and Affected Versions** Shopware version 6.6.10.4 **Description** A race condition exists in the voucher system, allowing attackers to bypass voucher restrictions and exceed usage limitations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** com.twelvemonkeys.imageio:imageio-metadata versions prior to 3.7.1 **Description** The issue is related to an insecurely initialized XML parser for reading XMP Metadata, which can lead to XML External Entity (XXE) Injection. An attacker can exploit this by supplying a file with a malicious XMP segment, such as when an online profile picture is processed. If the XMP metadata of the uploaded image is parsed, the XXE vulnerability is triggered. **Recommendations** For versions prior to 3.7.1, update to version 3.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of XMP metadata from untrusted sources until a patch is applied. Avoid using insecurely initialized XML parsers for reading XMP Metadata to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** elFinder.NetCore (affected versions not specified) **Description** The issue is related to insufficient validation in the ExtractAsync function within the FileSystem, allowing for arbitrary extraction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** elFinder.NetCore (affected versions not specified) **Description** The issue arises from the use of the Path.Combine(...) method to create an absolute file path without proper sanitation of user input and a check on the generated path. This allows for a path traversal attack, enabling an attacker to escape the Files directory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.