Xcuter

**Name of the Vulnerable Software and Affected Versions** DEXT5Upload versions 2.7.1262310 and earlier **Description** The issue allows remote files to be downloaded via a "dext5CMD=downloadRequest" action with traversal in the `fileVirtualPath` parameter, provided the attacker has the correct `fileOrgName` value. This is due to a Directory Traversal vulnerability in the handler/dext5handler.jsp file. **Recommendations** For versions 2.7.1262310 and earlier, as a temporary workaround, consider restricting access to the handler/dext5handler.jsp file until a patch is available. Avoid using the `fileVirtualPath` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MONITORAPP WAF (affected versions not specified) **Description** A Reflected Cross-Site Scripting (XSS) issue exists where script can be executed when responding to Request URL information. This occurs because the system provides a function to respond to Request URL information when blocking, allowing for potential script execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DEXT5 Editor versions through 3.5.1402961 **Description** The issue allows an attacker to download arbitrary files. This is achieved by exploiting the `savefilepath` field in the `handler/upload handler.jsp` file. **Recommendations** For versions through 3.5.1402961, restrict access to the `handler/upload handler.jsp` file to minimize the risk of exploitation. Avoid using the `savefilepath` field in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DEXT5 versions through 2.7.1402870 **Description** A remote code execution issue exists due to a vulnerability in DEXT5Upload. This allows an attacker to upload a PHP file via the "dext5handler.jsp" handler, as the uploaded file is stored under "dext5uploadeddata/". **Recommendations** For versions through 2.7.1402870, consider restricting access to the "dext5handler.jsp" handler to prevent unauthorized file uploads until a patch is available. As a temporary workaround, restrict the execution of PHP files in the "dext5uploadeddata/" directory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LimeSurvey versions 3.19.1 and earlier **Description** A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the `tolang` parameter in the "admin/translate/translateheader view.php" file. This can be demonstrated by accessing the "/index.php/admin/translate/sa/index/surveyid/336819/lang/" API endpoint. **Recommendations** For LimeSurvey versions 3.19.1 and earlier, as a temporary workaround, consider restricting access to the "admin/translate/translateheader view.php" file and avoiding the use of the `tolang` parameter in the affected API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WBCE CMS versions 1.4.0 and earlier **Description** A file-rename filter bypass issue exists in the admin/media/rename.php file. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension, potentially allowing remote attackers to execute arbitrary PHP code by manipulating the file name and extension. **Recommendations** For WBCE CMS versions 1.4.0 and earlier, as a temporary workaround, consider restricting access to the admin/media/rename.php file until a patch is available. Avoid using the file rename functionality in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.