Onur Yilmaz

**Name of the Vulnerable Software and Affected Versions** DataTables plugin versions 1.10.8 and earlier **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `scripts` parameter to "media/unit testing/templates/6776.php". This enables attackers to execute malicious scripts on the victim's browser. **Recommendations** Update to a version greater than 1.10.8, as a fix appears in version 1.10.10.

**Name of the Vulnerable Software and Affected Versions** concrete5 versions prior to 5.7.4 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters, including `banned word[]` to "/index.php/dashboard/system/conversations/bannedwords/success", `channel` to "/index.php/dashboard/reports/logs/view", `accessType` to "/index.php/tools/required/permissions/access entity", `msCountry` to "/index.php/dashboard/system/multilingual/setup/load icon", `arHandle` to "/index.php/ccm/system/dialogs/area/design/submit" or "/index.php/ccm/system/dialogs/area/design", `pageURL` to "/index.php/dashboard/pages/single", `SEARCH INDEX AREA METHOD` to "/index.php/dashboard/system/seo/searchindex/updated", `unit` to "/index.php/dashboard/system/optimization/jobs/job scheduled", `register notification email` to "/index.php/dashboard/system/registration/open/1", or `PATH INFO` to "/index.php/dashboard/extend/connect/". **Recommendations** For concrete5 versions prior to 5.7.4, update to version 5.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.