Marc Mahlke

**Nome do Software Vulnerável e Versões Afetadas** Zertificon Z1 SecureMail Z1 CertServer versão 3.16.4-2516-debian12 **Descrição** A falha permite que um atacante remoto execute código arbitrário via os parâmetros `ST`, `L`, `O`, `OU`, `CN`. Isso permite ao atacante realizar ações não autorizadas no sistema afetado. **Recomendações** Para o Zertificon Z1 SecureMail Z1 CertServer versão 3.16.4-2516-debian12, considere restringir o acesso aos parâmetros vulneráveis `ST`, `L`, `O`, `OU`, `CN` para minimizar o risco de exploração. Atualmente, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Nome do Software Vulnerável e Versões Afetadas** Zertificon Z1 SecureMail Z1 SecureMail Gateway versão 4.44.2-7240-debian12 **Descrição** A vulnerabilidade permite que um atacante remoto obtenha informações sensíveis através do componente "/compose-pdf.xhtml", especificamente explorando o parâmetro `convid`. Isso poderia potencialmente levar à exposição de dados confidenciais. **Recomendações** Para o Zertificon Z1 SecureMail Z1 SecureMail Gateway versão 4.44.2-7240-debian12, considere restringir o acesso ao componente "/compose-pdf.xhtml" até que uma correção esteja disponível, e evite usar o parâmetro `convid` neste endpoint para minimizar o risco de exploração. No momento, não há informações sobre uma versão mais recente que contenha uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `executionBlockName` parameter. This enables attackers to potentially manipulate the web application's behavior. **Recommendations** For General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3, consider restricting access to the `executionBlockName` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Tasktyp` parameter. **Recommendations** For General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3, consider restricting access to the `Tasktyp` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NAVBLUE S.A.S N-Ops & Crew version 22.5-rc.50 **Description** The issue is related to Cross Site Scripting (XSS), which is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For NAVBLUE S.A.S N-Ops & Crew version 22.5-rc.50, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `name` parameter. This enables the execution of malicious code on the affected system. **Recommendations** For General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3, consider restricting access to the `name` parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the `name` parameter in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `notification.message` parameter. This enables the execution of malicious code on the affected system. **Recommendations** For General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3, consider restricting access to the `notification.message` parameter to minimize the risk of exploitation until a patch is available. Avoid using the `notification.message` parameter in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `fieldname` parameter. This enables the execution of malicious code on the affected system. **Recommendations** For General Solutions Steiner GmbH CASE 3 Taskmanagement version 3.3, consider restricting access to the `fieldname` parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the `fieldname` parameter in sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.