Tristan Bizien

**Name of the Vulnerable Software and Affected Versions** Jalios JPlatform versions prior to 10.0.6 **Description** The DB chooser functionality in Jalios JPlatform improperly neutralizes special elements used in an SQL command, allowing authenticated administrative users to trigger SQL Injection. A patch was released on 2023-02-06. **Recommendations** For versions prior to 10.0.6, update to version 10.0.6 or apply the PatchPlugin release issued on 2023-02-06 to resolve the issue. As a temporary workaround, consider restricting access to the DB chooser functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jalios JPlatform versions prior to 10.0.8 Jalios Workplace versions 5.3 through 6.2 **Description** The issue is related to improper restriction of XML external entity references, allowing XML injection, and improper neutralization of input during web page generation, leading to cross-site scripting (XSS) vulnerabilities, including both reflected and stored XSS. **Recommendations** For Jalios JPlatform versions prior to 10.0.8, update to version 10.0.8 or later. For Jalios Workplace versions 5.3 through 6.2, consider disabling any features that generate web pages based on user input until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Jalios JPlatform versions prior to 10.0.8 (SP8) **Description** The issue is related to an Improper Restriction of XML External Entity Reference vulnerability, which allows XML Injection. **Recommendations** For versions prior to 10.0.8 (SP8), update to version 10.0.8 (SP8) or later to resolve the issue.