Yamerooo123

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions prior to 7.15.1 SuiteCRM versions prior to 8.9.3 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `return id` request parameter's value is copied into an HTML tag attribute, specifically an event handler, which is enclosed in double quotation marks. This can lead to a cross-site scripting (XSS) issue. **Recommendations** Update to SuiteCRM version 7.15.1 or later. Update to SuiteCRM version 8.9.3 or later. Implement a Content Security Policy (CSP) header to mitigate XSS.

**Name of the Vulnerable Software and Affected Versions** Dragon Age Origins version 1.05 **Description** The DAUpdaterSVC service in Dragon Age Origins contains an unquoted service path issue, allowing users to modify the executable file path used by the service. This service runs with NT AUTHORITYSYSTEM privileges, enabling attackers to escalate privileges by replacing or placing a malicious executable in the service path. **Recommendations** For Dragon Age Origins version 1.05, consider restricting access to the DAUpdaterSVC service to minimize the risk of exploitation. As a temporary workaround, avoid using the service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** UnoPim versions prior to 0.1.5 **Description** A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an embedded script. When the profile image is accessed, the embedded script executes, leading to the potential theft of session cookies. This issue can lead to session hijacking and privilege escalation, effectively bypassing any CSRF protections in place. **Recommendations** For versions prior to 0.1.5, update to version 0.1.5 to fix the vulnerability. As a temporary workaround, consider disabling the profile image upload feature in the Create User process until the update is applied. Restrict access to the Create User page to minimize the risk of exploitation. Avoid using the profile image feature in the Create User process until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Watcharr versions 1.43.0 and below Description: A vulnerability in a weak JWT token allows attackers to perform privilege escalation using a crafted JWT token. This issue is not limited to privilege escalation but also affects all functions that require authentication. Recommendations: For versions 1.43.0 and below, consider disabling authentication functions that rely on JWT tokens until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: UnoPim versions 0.1.3 and below Description: The issue is related to Cross Site Scripting (XSS) in the Create User function, allowing attackers to perform XSS via an SVG document. This can be used to steal cookies. The vulnerability is exploited through the Create User feature, where an attacker can use an SVG file extension to perform the XSS attack. Recommendations: For versions 0.1.3 and below, consider disabling the Create User function until a patch is available to prevent exploitation. Restrict access to the Create User feature to minimize the risk of XSS attacks. Avoid using the Create User function with SVG file extensions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.