0Xmanhnv

**Name of the Vulnerable Software and Affected Versions** ADSelfService Plus versions prior to 6529 RecoveryManager Plus versions prior to 6321 M365 Manager Plus versions prior to 4817 ADAudit Plus versions prior to 8703 **Description** In ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus (when deployed as integrated components within ManageEngine AD360), SSO tickets generated for session authentication can be predicted by an unauthenticated user. This allows an attacker to obtain a targeted user's identity and role information, leading to full account takeover and compromise of confidentiality, integrity, and availability across the affected systems. **Recommendations** Update ADSelfService Plus to version 6529 or later. Update RecoveryManager Plus to version 6321 or later. Update M365 Manager Plus to version 4817 or later. Update ADAudit Plus to version 8703 or later.

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.1 Description pMyFAQ, an open source FAQ web application, contains a flaw in its SVG sanitizer (`SvgSanitizer.php`). The regex-based sanitization can be bypassed by using HTML entity encoding within `javascript:` URLs inside SVG `<a href>` attributes. A user with `edit faq` permission can upload a malicious SVG file that executes arbitrary JavaScript when viewed. This allows for privilege escalation from an editor to a full admin takeover. The vulnerable file, `phpmyfaq/src/phpMyFAQ/Helper/SvgSanitizer.php`, uses a regex pattern that fails to detect HTML entity encoded `javascript:` URLs. The vulnerability is exploitable through the image upload endpoint `/admin/api/content/images` which requires only `edit faq` permission. The uploaded SVG files are served with `Content-Type: image/svg+xml` without a `Content-Disposition: attachment` header, enabling inline rendering and JavaScript execution. Recommendations Update phpMyFAQ to version 4.1.1 or later.