Paulino Calderon

**Nome do software vulnerável e versões afetadas** Versões 1.4.10 e 2.0.0-RC1 do Helidon **Descrição** A vulnerabilidade existe devido à validação insuficiente de entradas no componente Reactive WebServer do Helidon, permitindo que um invasor não autenticado com acesso à rede via HTTP comprometa o Helidon. Ataques bem-sucedidos podem resultar na tomada de controle do Helidon. A vulnerabilidade é difícil de explorar e pode ser aproveitada por um invasor para executar código arbitrário usando solicitações HTTP. **Recomendações** Para a versão 1.4.10, atualize para uma versão que inclua a correção para este problema. Para a versão 2.0.0-RC1, atualize para uma versão que inclua a correção para este problema. Como solução alternativa temporária, considere restringir o acesso ao componente Reactive WebServer até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 1.2.8 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO, affecting multiple pages, including "manage config email page.php", "manage config workflow page.php", and "bugs/plugin.php". **Recommendations** For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 1.2.8 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via the `os`, `os build`, or `platform` parameter to bug reporting or update pages, related to the use of the Projax library. This can be achieved by accessing specific API endpoints, such as bug report page.php or bug update advanced page.php. **Recommendations** For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the bug report page.php and bug update advanced page.php pages, and avoid using the `os`, `os build`, or `platform` parameters until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SmartSiteCMS version 1.0 **Description** The issue allows remote attackers to bypass authentication and gain administrator privileges. This is achieved by setting the `userName` cookie in the `admin.php` file. **Recommendations** For SmartSiteCMS version 1.0, consider restricting access to the `admin.php` file until a patch is available. As a temporary workaround, avoid using the `userName` cookie in the affected file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: JAWS version 0.4 Description: A cross-site scripting (XSS) issue exists in the NewTerm function in GlossaryModel.php, allowing remote attackers to inject arbitrary web script or HTML via the `term` or `description` variables. Recommendations: For JAWS version 0.4, as a temporary workaround, consider disabling the NewTerm function in GlossaryModel.php until a patch is available. Restrict input for the `term` and `description` variables to minimize the risk of exploitation.