Magicozo

**Nome do software vulnerável e versões afetadas: Versões 4.0.1 e anteriores do Bloodhound Descrição: A vulnerabilidade permite que invasores remotos executem comandos de sistema arbitrários quando uma vítima importa um arquivo de dados malicioso contendo JavaScript no parâmetro `objectId`. Isso ocorre no arquivo components/Modals/HelpTexts/GenericAll/GenericAll.jsx. Recomendações: Para as versões 4.0.1 e anteriores do Bloodhound, atualize para uma versão posterior à 4.0.1 para resolver o problema. Como solução temporária, considere restringir a importação de arquivos de dados a fontes confiáveis e evitar o uso do parâmetro `objectId` com entradas não confiáveis até que um patch esteja disponível.

Name of the Vulnerable Software and Affected Versions: phpIPAM versions prior to 1.4 Description: The issue is related to a SQL Injection flaw that can be exploited to access unauthorized information. The vulnerability is present in the /app/admin/nat/item-add-submit.php file and can be exploited by a malicious user. Recommendations: For versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /app/admin/nat/item-add-submit.php file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: PHPipam versions 1.3.2 and earlier Description: The issue concerns a CWE-79 vulnerability in the /app/admin/users/print-user.php file, which can lead to code execution in the victim's browser. This can be exploited by an attacker changing the theme parameter in user settings. The attack occurs when an admin views a user in the admin panel and gets exploited. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Recommendations: For PHPipam versions 1.3.2 and earlier, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /app/admin/users/print-user.php file and avoid using the theme parameter in user settings until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: phpIPAM versions 1.3.2 and earlier Description: The issue is related to a Cross Site Scripting (XSS) vulnerability in the subnet-scan-telnet.php file. This vulnerability can be exploited when a victim visits a link crafted by an attacker, potentially resulting in the execution of code in the victim's browser. Recommendations: For phpIPAM versions 1.3.2 and earlier, update to version 1.4 or later to resolve the issue.