Kenichi Maehashi

**Name of the Vulnerable Software and Affected Versions** Jenkins Dependency Graph Viewer plugin version 0.12 and earlier **Description** The issue concerns a lack of permission checks for the API endpoint that modifies the dependency graph. This allows anyone with Overall/Read permission to modify this data. **Recommendations** For Jenkins Dependency Graph Viewer plugin version 0.12 and earlier, update to a version that includes the necessary permission checks for the API endpoint that modifies the dependency graph.

**Name of the Vulnerable Software and Affected Versions** TransWARE Active! mail versions 2003.0139.0871 and earlier **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `From`, `To`, `Cc`, and `Bcc` parameters, potentially leading to cross-site scripting (XSS) attacks. **Recommendations** For TransWARE Active! mail versions 2003.0139.0871 and earlier, consider restricting the use of the `From`, `To`, `Cc`, and `Bcc` parameters until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TransWARE Active! mail 2003 versions 2003.0139.0871 and earlier **Description** The issue allows remote attackers to hijack web sessions via vectors such as an email with an embedded URL, due to the failure to remove the session ID in a Referer URL. **Recommendations** For TransWARE Active! mail 2003 versions 2003.0139.0871 and earlier, consider disabling the use of Referer URLs until a patch is available to remove the session ID and prevent web session hijacking.

**Name of the Vulnerable Software and Affected Versions** TransWARE Active! mail version 2003 build 2003.0139.0871 and earlier **Description** The issue is related to the improper securing of the session ID in a session cookie, which can be exploited by remote attackers to hijack web sessions. This is likely due to the mishandling of the "secure" flag for cookies in SSL sessions. **Recommendations** For TransWARE Active! mail version 2003 build 2003.0139.0871 and earlier, consider disabling the use of session cookies until a proper fix is applied to secure the session ID. As a temporary workaround, restrict access to sensitive areas of the application that rely on secure session management to minimize the risk of session hijacking. At the moment, there is no information about a newer version that contains a fix for this vulnerability.