Upasana

**Name of the Vulnerable Software and Affected Versions** Konica Minolta bizhub versions up to 20250202 **Description** A problematic issue was found in the Display MFP Information List component. The manipulation of the `Model Name` argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For versions up to 20250202, as a temporary workaround, consider restricting access to the Display MFP Information List component to minimize the risk of exploitation. Avoid using the `Model Name` argument in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Konica Minolta Bizhub versions up to 20250202 **Description** A problem has been detected that affects unknown code, leading to cross-site request forgery. The attack can be initiated remotely. **Recommendations** For versions up to 20250202, consider restricting access to prevent remote exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eastnets PaymentSafe version 2.5.26.0 **Description** A vulnerability was found in Eastnets PaymentSafe, affecting an unknown part of the file /directRouter.rfc of the component Edit Manual Reply Handler. The manipulation of the `Title` argument leads to basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. **Recommendations** For Eastnets PaymentSafe version 2.5.26.0, as a temporary workaround, consider restricting access to the `Edit Manual Reply Handler` component until a patch is available. Avoid using the `Title` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.