Xoffense

**Name of the Vulnerable Software and Affected Versions** eLabFTW versions prior to 4.0.0 **Description** This issue affects an open source electronic lab notebook for research labs, allowing an attacker to make GET requests on behalf of the server. The attack is "blind" because the attacker cannot see the result of the request. **Recommendations** For versions prior to 4.0.0, update to version 4.0.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FUDForum version 3.1.0 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject JavaScript via the "index.php" endpoint in the `srch` parameter. **Recommendations** For FUDForum version 3.1.0, consider disabling the `srch` parameter in the "index.php" endpoint until a patch is available. Restrict access to the "index.php" endpoint to minimize the risk of exploitation. Avoid using the `srch` parameter in the affected endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FUDForum version 3.1.0 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject JavaScript via the "index.php" endpoint in the `author` parameter. **Recommendations** For FUDForum version 3.1.0, as a temporary workaround, consider restricting access to the "index.php" endpoint or sanitizing the `author` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Products.PluggableAuthService versions prior to 2.6.1 **Description** The issue is an open redirect vulnerability, where a maliciously crafted link to the login form and login functionality could redirect the browser to a different website. **Recommendations** For versions prior to 2.6.1, update to version 2.6.1 by changing the buildout version pin to `2.6.1` and re-running the buildout, or by using `pip install "Products.PluggableAuthService>=2.6.1"`.