Tobias

**Name of the Vulnerable Software and Affected Versions** WebinarIgnition versions prior to 4.08.253 **Description** An improper limitation of a pathname to a restricted directory, known as Path Traversal, exists in the software. This allows access to files or directories outside of the intended restricted folder. **Recommendations** Update to version 4.08.253 or later.

**Name of the Vulnerable Software and Affected Versions** WebinarIgnition versions through 4.06.04 **Description** An authorization issue exists in WebinarIgnition, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update WebinarIgnition to a version later than 4.06.04.

**Name of the Vulnerable Software and Affected Versions** cashIT! - serving solutions versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 **Description** The issue is an unauthenticated remote code execution vulnerability that can be triggered by an HTTP endpoint exposed to the network. **Recommendations** For versions from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37, as a temporary workaround, consider restricting access to the exposed HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cashIT! - serving solutions versions to 03.A06rks 2023.02.37 **Description** The issue affects devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" and allows for the leakage of the database, including system settings and user accounts. This can be triggered by an HTTP endpoint exposed to the network. **Recommendations** For versions to 03.A06rks 2023.02.37, as a temporary workaround, consider restricting access to the exposed HTTP endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cashIT! - serving solutions versions 03.A06rks 2023.02.37 and earlier **Description** The issue is related to an origin bypass via the host header in an HTTP request. This can be triggered by an HTTP endpoint exposed to the network. **Recommendations** For versions 03.A06rks 2023.02.37 and earlier, consider restricting access to HTTP endpoints exposed to the network as a temporary workaround until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions 1.23.0 through 1.23.14 MediaWiki versions 1.26.0 through 1.26.3 MediaWiki versions 1.27.0 through 1.27.0 **Description** The issue allows remote attackers to bypass intended per-title read restrictions. This is achieved via a parse action to the "api.php" endpoint. **Recommendations** For MediaWiki versions 1.23.0 through 1.23.14, update to version 1.23.15 or later. For MediaWiki versions 1.26.0 through 1.26.3, update to version 1.26.4 or later. For MediaWiki versions 1.27.0 through 1.27.0, update to version 1.27.1 or later.

**Name of the Vulnerable Software and Affected Versions** HtmlCleaner versions prior to 2.6 Open-Xchange AppSuite version 7.2.2 before rev13 **Description** The issue is related to multiple race conditions that can be exploited by remote authenticated users. This can happen in opportunistic circumstances by leveraging the lack of thread safety. The exploitation can occur through a rapid series of operations, such as mail-sending or draft-saving. This allows attackers to read the private e-mail of other persons. **Recommendations** For HtmlCleaner versions prior to 2.6, update to version 2.6 or later to resolve the issue. For Open-Xchange AppSuite version 7.2.2 before rev13, apply rev13 or later to fix the problem.