Tino Kautschke

**Name of the Vulnerable Software and Affected Versions** Fabasoft Cloud Enterprise Client version 23.3.0.130 **Description** The issue allows a user to escalate their privileges to local administrator. **Recommendations** For Fabasoft Cloud Enterprise Client version 23.3.0.130, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fabasoft Cloud Enterprise Client version 22.4.0043 **Description** The issue concerns the folioupdate service, which allows Local Privilege Escalation. **Recommendations** For Fabasoft Cloud Enterprise Client version 22.4.0043, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plone versions through 5.2.4 **Description** The issue allows for cross-site scripting (XSS) due to the mishandling of a full name during the rendering of the ownership tab of a content item. **Recommendations** For versions through 5.2.4, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Plone versions through 5.2.4 **Description** The issue allows stored XSS attacks by uploading an SVG or HTML document, which can be exploited by a Contributor. **Recommendations** For versions through 5.2.4, update to a version that contains a fix for this issue to prevent stored XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Plone CMS versions prior to 5.2.4 **Description** The issue is related to a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user, allowing an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload. **Recommendations** For Plone CMS versions prior to 5.2.4, update to version 5.2.4 or later to resolve the issue. As a temporary workaround, consider restricting user input data to minimize the risk of exploitation. Avoid using the file upload functionality and the user fullname property until the issue is resolved.