Truff

**Name of the Vulnerable Software and Affected Versions** Kiteworks versions prior to 9.3.0 **Description** A reflected Cross-Site Scripting (XSS) issue in Kiteworks Secure Data Forms allows an external attacker to trick a user into executing arbitrary JavaScript code. Cross-Site Scripting is a flaw where malicious scripts are injected into otherwise trusted websites. **Recommendations** Update to version 9.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Kiteworks versions prior to 9.3.0 **Description** Kiteworks is a private data network (PDN). Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms allow an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and certain global configuration parameters. SQL Injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** Upgrade to version 9.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins LDAP Plugin versions prior to 807.v7d7de30930cf **Description** The plugin deserializes data from LDAP referrals without proper validation. Deserialization is the process of converting a data stream back into an object, which, when performed on untrusted data without validation, can lead to security compromises. **Recommendations** Update to a version later than 807.v7d7de30930cf.

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.1.6 through 2026.1.11 Description A flaw exists in the multi-factor authentication (MFA) management API of Devolutions Server that allows an authenticated attacker to remove their own MFA factors, reducing account security to password-only authentication through specifically crafted HTTP requests. Recommendations Update Devolutions Server to a version later than 2026.1.11.

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.1 through 2025.3.17 and 2026.1.1 through 2026.1.11 Description A flaw exists in the gateway health check feature that permits a low-privileged authenticated user to conduct server-side request forgery (SSRF). Successful exploitation could lead to information disclosure through a specially crafted API request. The vulnerable component is the gateway health check feature, and the attack involves improper input validation. Recommendations Update Devolutions Server to a version later than 2026.1.11. Update Devolutions Server to a version later than 2025.3.17.

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.2.0 Description Kiteworks is a private data network (PDN). Prior to version 9.2.0, a flaw in the configuration functionality allows bypassing of Server-Side Request Forgery (SSRF) protections through DNS rebinding attacks. Malicious administrators could exploit this to access restricted internal services. Recommendations Update to version 9.2.0 or later.

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.2.0 Description Kiteworks is a private data network (PDN). A configuration issue allows the upload of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Recommendations Update to version 9.2.0 or later.

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.2.0 Description Kiteworks is a private data network (PDN). Prior to version 9.2.0, a flaw in the command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Recommendations Update to version 9.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Artifex Ghostscript versions prior to 10.05.0 **Description** The issue is related to the mishandling of overlong UTF-8 encoding in the decode utf8 function in base/gp utf8.c. This problem exists due to an incomplete fix for a previous issue. **Recommendations** For versions prior to 10.05.0, update to version 10.05.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the decode utf8 function in base/gp utf8.c until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Collabora Online versions prior to 24.04.12.4 Collabora Online versions prior to 23.05.19 Collabora Online versions prior to 22.05.25 **Description** Collabora Online is a collaborative online office suite based on LibreOffice technology. A path traversal flaw exists in handling the `BaseFileName` field returned from WOPI servers, allowing a file to be written anywhere the uid running Collabora Online can write if a malicious response is supplied by a WOPI server. This issue can be combined with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, enabling the presentation of such a response to be processed by a Collabora Online instance. **Recommendations** For versions prior to 24.04.12.4, update to version 24.04.13.1 or later. For versions prior to 23.05.19, update to version 23.05.19 or later. For versions prior to 22.05.25, update to version 22.05.25 or later. As a temporary workaround, consider restricting access to the WOPI server integration until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apache Allura versions 1.0.1 through 1.16.0 **Description** The import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. **Recommendations** For versions 1.0.1 through 1.16.0, upgrade to version 1.17.0 to fix the issue. If unable to upgrade, set `disable entry points.allura.importers = forge-tracker, forge-discussion` in the .ini config file as a temporary workaround.